Cross-site scripting in Go programming language - CVE-2021-33195

Vulnerability identifier: #VU56022

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-33195

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of data passed from DNS lookups. A remote attacker can send a specially crafted DNS reqponse and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Go programming language
Gentoo Linux
Arch Linux
Oracle Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Fedora
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
openEuler
golang-github-prometheus-promu (Red Hat package)
containernetworking-plugins (Red Hat package)
butane (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
kubevirt (Red Hat package)
ignition (Red Hat package)
jenkins (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
jenkins-2-plugins (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
golang
golang-devel
golang-help
go1.15-race
go1.15
go1.15-doc
go-toolset-1.15-golang (Red Hat package)
go1.16-race
go1.16
go1.16-doc
buildah (Red Hat package)
go
etcd (Red Hat package)
mcg (Red Hat package)
grafana (Red Hat package)
ObjectScale
Asset Repository in IBM Cloud Pak for Integration (CP4I)
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Dell PowerProtect Cyber Recovery
QRadar Suite
Splunk Enterprise
Red Hat OpenShift Jaeger
IBM Cloud Pak for Multicloud Management Monitoring
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat OpenStack
Red Hat OpenStack for IBM Power
IBM Robotic Process Automation
Operations Dashboard
Netcool Operations Insight
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat OpenShift Container Platform
Migration Toolkit for Containers

Install updates from vendor's website.

Go programming language - addressed in versions 1.15.13, 1.16.5
golang-github-prometheus-promu (Red Hat package) - update to 0.5.0-4.git642a960.el8
containernetworking-plugins (Red Hat package) - update to 0.8.6-3.rhaos4.6.el7
butane (Red Hat package) - update to 0.12.1-2.rhaos4.8.el8
ObjectScale - update to 1.3.0
QRadar Suite - update to 1.10.17.0
Red Hat OpenShift Jaeger - update to 1.20.5
cri-o (Red Hat package) - addressed in versions 1.19.3-8.rhaos4.6.git0fa2911.el7, 1.19.3-8.rhaos4.6.git0fa2911.el8, 1.20.4-7.rhaos4.7.git6287500.el7, 1.20.4-7.rhaos4.7.git6287500.el8, 1.21.2-8.rhaos4.8.git8d4264e.el7, 1.21.2-8.rhaos4.8.git8d4264e.el8, 1.21.2-13.rhaos4.8.git52b3f98.el7, 1.21.2-13.rhaos4.8.git52b3f98.el8, 1.21.3-6.rhaos4.8.gite34bf50.el7, 1.21.3-6.rhaos4.8.gite34bf50.el8
cri-tools (Red Hat package) - update to 1.21.0-3.el8
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 4.0.2
OpenShift Virtualization - addressed in versions 2.6.10, 4.8.2, 4.8.5, 4.9.0, 4.9.2, 4.10.0
kubevirt (Red Hat package) - addressed in versions 2.6.10-230.el7, 2.6.10-230.el8, 4.8.5-278.el7, 4.8.5-278.el8
ignition (Red Hat package) - addressed in versions 2.6.0-8.rhaos4.6.git947598e.el8, 2.9.0-4.rhaos4.7.git1d56dc8.el8, 2.9.0-7.rhaos4.8.el8
jenkins (Red Hat package) - update to 2.289.3.1633554819-1.el8
Red Hat OpenShift Container Platform - addressed in versions 4.6.42, 4.7.23, 4.8.4, 4.8.9, 4.8.15
openshift-kuryr (Red Hat package) - addressed in versions 4.6.0-202107300032.p0.git.0063daa.el8, 4.7.0-202107291238.p0.git.c7654fb.assembly.stream.el8, 4.8.0-202107291413.p0.git.8a4c2d8.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.4ec6967.el7, 4.7.0-202107292046.p0.git.e1b19c2.assembly.stream.el7, 4.8.0-202107292023.p0.git.626f7a3.assembly.stream.el7, 4.8.0-202109241839.p0.git.4bb45f8.assembly.stream.el7
openshift (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.4c3480d.el7, 4.6.0-202107292126.p0.git.4c3480d.el8, 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7, 4.7.0-202107292242.p0.git.558d959.assembly.stream.el8, 4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7, 4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.2b525e8.el7, 4.6.0-202107292126.p0.git.2b525e8.el8, 4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7, 4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8, 4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7, 4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8, 4.8.0-202108120034.p0.git.0d10c3f.assembly.stream.el7, 4.8.0-202108120034.p0.git.0d10c3f.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.6.0-202107291238.p0.git.39cfc66.el8, 4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8, 4.8.0-202107291413.p0.git.39cfc66.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1633555500-1.el8
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210730151213.5b801be.el8
ovn2.13 (Red Hat package) - update to 20.12.0-140.el8fdp
IBM Robotic Process Automation - update to 21.0.3.1
redhat-release-coreos (Red Hat package) - update to 47.84-1.el8
Asset Repository in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-3, 2021.2.1-1
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-4, 2021.3.1
Operations Dashboard - addressed in versions 2020.4.1-3, 2021.3.1
Migration Toolkit for Containers - update to 1.5.1
Netcool Operations Insight - update to 1.6.6
golang - update to 1.15.7-5
golang-devel - update to 1.15.7-5
golang-help - update to 1.15.7-5
go1.15-race - update to 1.15.13-1.33.1
go1.15 - update to 1.15.13-1.33.1
go1.15-doc - update to 1.15.13-1.33.1
golang - update to 1.15.14-1.el7
go-toolset-1.15-golang (Red Hat package) - update to 1.15.14-2.el7_9
go1.16-race - update to 1.16.5-1.17.1
go1.16 - update to 1.16.5-1.17.1
go1.16-doc - update to 1.16.5-1.17.1
buildah (Red Hat package) - update to 1.27.0-2.el9
go - update to 2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.2
etcd (Red Hat package) - update to 3.3.23-3.1.el8ost.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.9.0
mcg (Red Hat package) - update to 5.9.0-28.61dcf87.5.9.el8
grafana (Red Hat package) - update to 7.5.9-4.el8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

• https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
• https://groups.google.com/g/golang-announce

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization 4.8
• Multiple vulnerabilities in Red Hat OpenShift Virtualization 2.6
• SUSE update for go1.16
• SUSE update for go1.15
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Gentoo update for Go
• Multiple vulnerabilities in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Operations Dashboard
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Red Hat Enterprise Linux 9 update for buildah
• Multiple vulnerabilities in Netcool Operations Insight
• Red Hat Developer Tools update for go-toolset-1.15-golang
• Red Hat OpenStack Platform 16 update for etcd
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat OpenStack Platform 16 update for etcd
• Arch Linux update for go
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM QRadar Suite software
• openEuler update for golang
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Fedora EPEL 7 update for golang
• Multiple vulnerabilities in Dell ObjectScale