Input validation error in Go programming language - CVE-2021-27919

Vulnerability identifier: #VU51485

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-27919

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Reader.Open API when use a ZIP archive containing files start with “../”. A remote attacker can trick a victim to open a specially crafted ZIP archive and perform a denial of service (DoS) attack.

Go programming language
Gentoo Linux
SUSE Linux Enterprise Module for Development Tools
Fedora
Splunk Enterprise
IBM API Connect
go1.16
go1.16-doc
go1.16-race
golang

Install updates from vendor's website.

Go programming language - update to 1.16.1
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM API Connect - addressed in versions 10.0.1.2, 10.0.3, 2018.4.1.17
go1.16 - update to 1.16.2-1.8.1
go1.16-doc - update to 1.16.2-1.8.1
go1.16-race - update to 1.16.2-1.8.1
golang - addressed in versions 1.16.8-1.fc34, 1.16.8-2.fc35

• https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw

• Multiple vulnerabilities in Golang Go
• Gentoo update for Go
• Denial of service in IBM API Connect
• SUSE update for go1.16
• Splunk Enterprise update for third-party packages
• Fedora 34 update for golang
• Fedora 35 update for golang