high
7.5
CWE
125 20
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2021-38561: Input Validation

First published: Thu Aug 12 2021(Updated: )

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
redhat/cri-o<0:1.24.5-2.rhaos4.11.gitb007cb6.el8
0:1.24.5-2.rhaos4.11.gitb007cb6.el8
redhat/haproxy<0:2.2.24-3.rhaos4.11.el8
0:2.2.24-3.rhaos4.11.el8
redhat/kernel-rt<0:4.18.0-372.51.1.rt7.208.el8_6
0:4.18.0-372.51.1.rt7.208.el8_6
redhat/openshift<0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8
0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8
redhat/kubevirt<0:4.12.0-1057.el7
0:4.12.0-1057.el7
redhat/kubevirt<0:4.12.0-1057.el8
0:4.12.0-1057.el8
Golang Text<0.3.7
go/golang.org/x/text<0.3.7
0.3.7

Remedy

https://deps.dev/advisory/OSV/GO-2021-0113

Remedy

https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2021-38561?

    CVE-2021-38561 is a vulnerability in the golang.org/x/text/language package in golang.org/x/text before version 0.3.7.

  • How severe is CVE-2021-38561?

    CVE-2021-38561 has a severity rating of 7.5 (high).

  • Which software is affected by CVE-2021-38561?

    The golang.org/x/text package before version 0.3.7, cri-o before version 0:1.24.5-2.rhaos4.11.gitb007cb6.el8, haproxy before version 0:2.2.24-3.rhaos4.11.el8, kernel-rt before version 0:4.18.0-372.51.1.rt7.208.el8_6, openshift before version 0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8, kubevirt before versions 0:4.12.0-1057.el7 and 0:4.12.0-1057.el8, and the Golang Text library before version 0.3.7 are affected by CVE-2021-38561.

  • How can CVE-2021-38561 be exploited?

    CVE-2021-38561 can be exploited by an attacker using an incorrectly formatted language tag to cause applications using the vulnerable package to crash or panic.

  • How can I fix CVE-2021-38561?

    To fix CVE-2021-38561, update the affected software packages to version 0.3.7 or later.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203