Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2021-27918 CVE-2021-27919 |
CWE-ID | CWE-835 CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
SUSE Linux Enterprise Module for Development Tools Operating systems & Components / Operating system go1.16-race Operating systems & Components / Operating system package or component go1.16-doc Operating systems & Components / Operating system package or component go1.16 Operating systems & Components / Operating system package or component |
Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU51486
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2021-27918
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when using xml.NewTokenDecoder with a custom TokenReader. A remote attacker can trick a victim to open a specially crafted XML content and cause denial of service conditions.
MitigationUpdate the affected package go1.16 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Development Tools: 15-SP2
go1.16-race: before 1.16.2-1.8.1
go1.16-doc: before 1.16.2-1.8.1
go1.16: before 1.16.2-1.8.1
Fixed software versionsCPE2.3 External links
http://www.suse.com/support/update/announcement/2021/suse-su-20210937-1/
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU51485
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2021-27919
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the Reader.Open API when use a ZIP archive containing files start with “../”. A remote attacker can trick a victim to open a specially crafted ZIP archive and perform a denial of service (DoS) attack.
MitigationUpdate the affected package go1.16 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Development Tools: 15-SP2
go1.16-race: before 1.16.2-1.8.1
go1.16-doc: before 1.16.2-1.8.1
go1.16: before 1.16.2-1.8.1
Fixed software versionsCPE2.3 External links
http://www.suse.com/support/update/announcement/2021/suse-su-20210937-1/
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?