CVE-2021-38561: Input Validation
A flaw was found in golang. The language package for go language can panic due to an out-of-bounds read when an incorrectly formatted language tag is being parsed. This flaw allows an attacker to cause applications using this package to parse untrusted input data to crash, leading to a denial of service of the affected component.
Other sources
Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack.
— Red Hat
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:5556
- RHSA-2022:5525
- RHSA-2022:5909
- RHSA-2022:5908
- RHSA-2022:6346
- RHBA-2023:1649
- RHSA-2022:5070
- RHSA-2022:6287
- RHSA-2022:6537
- RHSA-2023:0245
- RHSA-2023:0566
- RHSA-2023:0652
- RHSA-2023:0774
- RHSA-2023:0895
- RHSA-2023:1504
- RHSA-2023:3542
- RHSA-2023:4310
- RHSA-2022:7399
- RHSA-2022:7401
- RHSA-2023:0890
- RHSA-2023:1409
- RHSA-2023:1326
- RHSA-2023:1328
- RHSA-2022:6263
- RHSA-2022:6318
- RHSA-2023:0407
- RHSA-2022:6526
- RHSA-2022:8750
- RHSA-2023:0408
- RHSA-2022:6051
Frequently Asked Questions
What is CVE-2021-38561?
CVE-2021-38561 is a vulnerability in the golang.org/x/text/language package in golang.org/x/text before version 0.3.7.
How severe is CVE-2021-38561?
CVE-2021-38561 has a severity rating of 7.5 (high).
Which software is affected by CVE-2021-38561?
The golang.org/x/text package before version 0.3.7, cri-o before version 0:1.24.5-2.rhaos4.11.gitb007cb6.el8, haproxy before version 0:2.2.24-3.rhaos4.11.el8, kernel-rt before version 0:4.18.0-372.51.1.rt7.208.el8_6, openshift before version 0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8, kubevirt before versions 0:4.12.0-1057.el7 and 0:4.12.0-1057.el8, and the Golang Text library before version 0.3.7 are affected by CVE-2021-38561.
How can CVE-2021-38561 be exploited?
CVE-2021-38561 can be exploited by an attacker using an incorrectly formatted language tag to cause applications using the vulnerable package to crash or panic.
How can I fix CVE-2021-38561?
To fix CVE-2021-38561, update the affected software packages to version 0.3.7 or later.