Wind River Support Network

HomeDefectsLIN1019-6960

Acknowledged

LIN1019-6960 : Security Advisory - go - CVE-2021-29923

Created: Aug 8, 2021 Updated: Aug 11, 2021

Found In Version: 10.19.45.1

Severity: Standard

Applicable for: Wind River Linux LTS 19

Component/s: Userspace

Description

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

CREATE(Triage):(User=admin) [CVE-2021-29923|https://nvd.nist.gov/vuln/detail/CVE-2021-29923]