Missing Authorization in Go programming language - CVE-2021-33197

Vulnerability identifier: #VU56023

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33197

CWE-ID: CWE-862

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to an error in some configurations of ReverseProxy (from net/http/httputil). A remote attacker can drop arbitrary headers and bypass authorization process. 

Go programming language
Amazon Linux AMI
Gentoo Linux
Arch Linux
Oracle Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
openEuler
golang-github-prometheus-promu (Red Hat package)
containernetworking-plugins (Red Hat package)
butane (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
kubevirt (Red Hat package)
ignition (Red Hat package)
jenkins (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
jenkins-2-plugins (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
golang
golang-devel
golang-help
go1.15-race
go1.15-doc
go1.15
go-toolset-1.15-golang (Red Hat package)
go1.16-doc
go1.16-race
go1.16
buildah (Red Hat package)
go
etcd (Red Hat package)
podman (Red Hat package)
mcg (Red Hat package)
grafana (Red Hat package)
ObjectScale
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Asset Repository in IBM Cloud Pak for Integration (CP4I)
Dell PowerProtect Cyber Recovery
QRadar Suite
Splunk Enterprise
Red Hat OpenShift Jaeger
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Cloud Pak for Multicloud Management Monitoring
Red Hat OpenStack
Red Hat OpenStack for IBM Power
IBM Robotic Process Automation
Operations Dashboard
Netcool Operations Insight
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
Cloud Pak for Data

Install updates from vendor's website.

Go programming language - addressed in versions 1.15.13, 1.16.5
golang-github-prometheus-promu (Red Hat package) - update to 0.5.0-4.git642a960.el8
containernetworking-plugins (Red Hat package) - update to 0.8.6-3.rhaos4.6.el7
butane (Red Hat package) - update to 0.12.1-2.rhaos4.8.el8
ObjectScale - update to 1.3.0
QRadar Suite - update to 1.10.17.0
Red Hat OpenShift Jaeger - update to 1.20.5
cri-o (Red Hat package) - addressed in versions 1.19.3-8.rhaos4.6.git0fa2911.el7, 1.19.3-8.rhaos4.6.git0fa2911.el8, 1.20.4-7.rhaos4.7.git6287500.el7, 1.20.4-7.rhaos4.7.git6287500.el8, 1.21.2-8.rhaos4.8.git8d4264e.el7, 1.21.2-8.rhaos4.8.git8d4264e.el8, 1.21.2-13.rhaos4.8.git52b3f98.el7, 1.21.2-13.rhaos4.8.git52b3f98.el8, 1.21.3-6.rhaos4.8.gite34bf50.el7, 1.21.3-6.rhaos4.8.gite34bf50.el8
cri-tools (Red Hat package) - update to 1.21.0-3.el8
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 4.0.2
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
OpenShift Virtualization - addressed in versions 2.6.10, 4.8.2, 4.8.5, 4.9.0, 4.9.2, 4.10.0
kubevirt (Red Hat package) - addressed in versions 2.6.10-230.el7, 2.6.10-230.el8, 4.8.5-278.el7, 4.8.5-278.el8
ignition (Red Hat package) - addressed in versions 2.6.0-8.rhaos4.6.git947598e.el8, 2.9.0-4.rhaos4.7.git1d56dc8.el8, 2.9.0-7.rhaos4.8.el8
jenkins (Red Hat package) - update to 2.289.3.1633554819-1.el8
Red Hat OpenShift Container Platform - addressed in versions 4.6.42, 4.7.23, 4.8.4, 4.8.9, 4.8.15
openshift-kuryr (Red Hat package) - addressed in versions 4.6.0-202107300032.p0.git.0063daa.el8, 4.7.0-202107291238.p0.git.c7654fb.assembly.stream.el8, 4.8.0-202107291413.p0.git.8a4c2d8.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.4ec6967.el7, 4.7.0-202107292046.p0.git.e1b19c2.assembly.stream.el7, 4.8.0-202107292023.p0.git.626f7a3.assembly.stream.el7, 4.8.0-202109241839.p0.git.4bb45f8.assembly.stream.el7
openshift (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.4c3480d.el7, 4.6.0-202107292126.p0.git.4c3480d.el8, 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7, 4.7.0-202107292242.p0.git.558d959.assembly.stream.el8, 4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7, 4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.2b525e8.el7, 4.6.0-202107292126.p0.git.2b525e8.el8, 4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7, 4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8, 4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7, 4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8, 4.8.0-202108120034.p0.git.0d10c3f.assembly.stream.el7, 4.8.0-202108120034.p0.git.0d10c3f.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.6.0-202107291238.p0.git.39cfc66.el8, 4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8, 4.8.0-202107291413.p0.git.39cfc66.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1633555500-1.el8
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210730151213.5b801be.el8
ovn2.13 (Red Hat package) - update to 20.12.0-140.el8fdp
IBM Robotic Process Automation - update to 21.0.3.1
redhat-release-coreos (Red Hat package) - update to 47.84-1.el8
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-4, 2021.3.1
Asset Repository in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-3, 2021.2.1-1
Operations Dashboard - addressed in versions 2020.4.1-3, 2021.3.1
Migration Toolkit for Containers - update to 1.5.1
Netcool Operations Insight - update to 1.6.6
golang - update to 1.15.7-5
golang-devel - update to 1.15.7-5
golang-help - update to 1.15.7-5
go1.15-race - update to 1.15.13-1.33.1
go1.15-doc - update to 1.15.13-1.33.1
go1.15 - update to 1.15.13-1.33.1
golang - update to 1.15.14-1.el7
go-toolset-1.15-golang (Red Hat package) - update to 1.15.14-2.el7_9
go1.16-doc - update to 1.16.5-1.17.1
go1.16-race - update to 1.16.5-1.17.1
go1.16 - update to 1.16.5-1.17.1
buildah (Red Hat package) - update to 1.27.0-2.el9
go - update to 2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.2
etcd (Red Hat package) - update to 3.3.23-3.1.el8ost.1
podman (Red Hat package) - update to 4.2.0-3.el9
Cloud Pak for Data - update to 4.8.5
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.9.0
mcg (Red Hat package) - update to 5.9.0-28.61dcf87.5.9.el8
grafana (Red Hat package) - update to 7.5.9-4.el8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

• https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
• https://groups.google.com/g/golang-announce

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization 4.8
• Multiple vulnerabilities in Red Hat OpenShift Virtualization 2.6
• SUSE update for go1.16
• SUSE update for go1.15
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Gentoo update for Go
• Multiple vulnerabilities in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Operations Dashboard
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9 update for podman
• Multiple vulnerabilities in Netcool Operations Insight
• Red Hat Developer Tools update for go-toolset-1.15-golang
• Red Hat OpenStack Platform 16 update for etcd
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat OpenStack Platform 16 update for etcd
• Arch Linux update for go
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM QRadar Suite software
• openEuler update for golang
• Missing authorization in IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Fedora EPEL 7 update for golang
• Multiple vulnerabilities in Dell ObjectScale