CVE-2021-33196: Input Validation
First published: Tue May 25 2021(Updated: )
A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openshift-serverless-clients | <0:0.22.0-3.el8 | 0:0.22.0-3.el8 |
| redhat/openshift-serverless-clients | <0:0.23.2-1.el8 | 0:0.23.2-1.el8 |
| redhat/go-toolset | <1.15-0:1.15.13-1.el7_9 | 1.15-0:1.15.13-1.el7_9 |
| redhat/go-toolset | <1.15-golang-0:1.15.13-1.el7_9 | 1.15-golang-0:1.15.13-1.el7_9 |
| redhat/cri-o | <0:1.21.2-8.rhaos4.8.git8d4264e.el8 | 0:1.21.2-8.rhaos4.8.git8d4264e.el8 |
| redhat/openshift-clients | <0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8 | 0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8 |
| redhat/openshift | <0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 |
| Golang Go | <1.15.13 | |
| Golang Go | >=1.16.0<1.16.5 | |
| Debian Debian Linux | =9.0 | |
| redhat/go | <1.17.0 | 1.17.0 |
| redhat/go | <1.16.5 | 1.16.5 |
| redhat/go | <1.15.13 | 1.15.13 |
| IBM Security Guardium Insights | <=3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-33196 https://nvd.nist.gov/vuln/detail/CVE-2021-33196 https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
- https://bugzilla.redhat.com/show_bug.cgi?id=1965503
- https://access.redhat.com/errata/RHSA-2021:2705
- https://access.redhat.com/errata/RHSA-2021:3556
- https://access.redhat.com/errata/RHSA-2021:2704
- https://access.redhat.com/errata/RHSA-2021:3555
- https://access.redhat.com/errata/RHSA-2021:2634
- https://access.redhat.com/errata/RHSA-2021:3076
- https://access.redhat.com/errata/RHSA-2021:3361
- https://access.redhat.com/errata/RHSA-2021:2984
- https://access.redhat.com/errata/RHSA-2021:2983
- https://access.redhat.com/errata/RHSA-2021:3758
- https://access.redhat.com/security/cve/cve-2021-33196
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
- https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
- https://security.gentoo.org/glsa/202208-02
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912
- https://github.com/golang/go/issues/46242
- https://golang.org/cl/322949
- https://golang.org/cl/322909
- https://golang.org/cl/318909
- https://github.com/golang/go/commit/74242baa4136c7a9132a8ccd9881354442788c8c
- https://access.redhat.com/errata/RHSA-2021:3229
- https://exchange.xforce.ibmcloud.com/vulnerabilities/206602
- https://www.ibm.com/support/pages/node/6550866 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-33196?
CVE-2021-33196 is a vulnerability in the archive/zip package in Go before version 1.15.13 and 1.16.x before version 1.16.5.
How does the vulnerability in the archive/zip package in Go work?
The vulnerability in the archive/zip package in Go can be exploited by persuading a victim to open a specially-crafted archive file, causing a panic or unrecoverable fatal error.
What is the severity of CVE-2021-33196?
CVE-2021-33196 has a severity rating of 7.5 (high).
How do I fix the vulnerability in the archive/zip package in Go?
To fix the vulnerability, update your version of Go to at least version 1.17.0, 1.16.5, or 1.15.13, depending on your current version.
Where can I find more information about CVE-2021-33196?
You can find more information about CVE-2021-33196 in the following references: [Link 1](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912), [Link 2](https://github.com/golang/go/issues/46242), [Link 3](https://golang.org/cl/322949).
- collector/redhat-cve
- collector/nvd-index
- agent/first-publish-date
- agent/type
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-33196
- agent/software-canonical-lookup
- agent/event
- agent/description
- collector/ibm-support
- source/IBM
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- vendor/golang
- canonical/golang go
- version/golang go/1.16.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/ibm
- canonical/ibm security guardium insights
- version/ibm security guardium insights/3.0