Resource management error in Go programming language - CVE-2021-33198

Vulnerability identifier: #VU56024

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-33198

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling a large exponent to the math/big.Rat SetString or UnmarshalText method.  A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Go programming language
Amazon Linux AMI
Gentoo Linux
Arch Linux
Oracle Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Fedora
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
openEuler
golang-github-prometheus-promu (Red Hat package)
containernetworking-plugins (Red Hat package)
butane (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
kubevirt (Red Hat package)
ignition (Red Hat package)
jenkins (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
jenkins-2-plugins (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
toolbox
toolbox-tests
udica
runc
slirp4netns
oci-seccomp-bpf-hook
containernetworking-plugins
skopeo (Red Hat package)
aardvark-dns
netavark
fuse-overlayfs
crun
skopeo-tests
skopeo
golang
golang-help
golang-devel
go1.15-race
go1.15-doc
go1.15
go1.16-race
go1.16
go1.16-doc
buildah (Red Hat package)
buildah
buildah-tests
containers-common
go
conmon
container-selinux
etcd (Red Hat package)
crit
python3-criu
criu-libs
criu-devel
criu
libslirp-devel
libslirp
python3-podman
podman-catatonit
podman
podman-gvproxy
podman-plugins
podman-remote
podman-tests
podman-docker
mcg (Red Hat package)
cockpit-podman
ObjectScale
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Asset Repository in IBM Cloud Pak for Integration (CP4I)
Dell PowerProtect Cyber Recovery
App Connect Enterprise Certified Container
IBM Cloud Pak for Multicloud Management Monitoring
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat OpenStack for IBM Power
Red Hat OpenStack
IBM Robotic Process Automation
Netcool Operations Insight
Red Hat Advanced Cluster Management for Kubernetes
QRadar Suite
Juniper Secure Analytics (JSA)
Splunk Enterprise
Red Hat OpenShift Jaeger
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
IBM Qradar SIEM
IBM Security Verify Access

Install updates from vendor's website.

Go programming language - addressed in versions 1.15.13, 1.16.5
golang-github-prometheus-promu (Red Hat package) - update to 0.5.0-4.git642a960.el8
containernetworking-plugins (Red Hat package) - update to 0.8.6-3.rhaos4.6.el7
butane (Red Hat package) - update to 0.12.1-2.rhaos4.8.el8
ObjectScale - update to 1.3.0
App Connect Enterprise Certified Container - addressed in versions 1.1.3, 1.5.2
QRadar Suite - update to 1.10.17.0
Red Hat OpenShift Jaeger - update to 1.20.5
cri-o (Red Hat package) - addressed in versions 1.19.3-8.rhaos4.6.git0fa2911.el7, 1.19.3-8.rhaos4.6.git0fa2911.el8, 1.20.4-7.rhaos4.7.git6287500.el7, 1.20.4-7.rhaos4.7.git6287500.el8, 1.21.2-8.rhaos4.8.git8d4264e.el7, 1.21.2-8.rhaos4.8.git8d4264e.el8, 1.21.2-13.rhaos4.8.git52b3f98.el7, 1.21.2-13.rhaos4.8.git52b3f98.el8, 1.21.3-6.rhaos4.8.gite34bf50.el7, 1.21.3-6.rhaos4.8.gite34bf50.el8
cri-tools (Red Hat package) - update to 1.21.0-3.el8
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 4.0.2
OpenShift Virtualization - addressed in versions 2.6.10, 4.8.2, 4.8.5, 4.9.0, 4.9.2, 4.10.0
kubevirt (Red Hat package) - addressed in versions 2.6.10-230.el7, 2.6.10-230.el8, 4.8.5-278.el7, 4.8.5-278.el8
ignition (Red Hat package) - addressed in versions 2.6.0-8.rhaos4.6.git947598e.el8, 2.9.0-4.rhaos4.7.git1d56dc8.el8, 2.9.0-7.rhaos4.8.el8
jenkins (Red Hat package) - update to 2.289.3.1633554819-1.el8
Red Hat OpenShift Container Platform - addressed in versions 4.6.42, 4.7.23, 4.8.4, 4.8.9, 4.8.15
openshift-kuryr (Red Hat package) - addressed in versions 4.6.0-202107300032.p0.git.0063daa.el8, 4.7.0-202107291238.p0.git.c7654fb.assembly.stream.el8, 4.8.0-202107291413.p0.git.8a4c2d8.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.4ec6967.el7, 4.7.0-202107292046.p0.git.e1b19c2.assembly.stream.el7, 4.8.0-202107292023.p0.git.626f7a3.assembly.stream.el7, 4.8.0-202109241839.p0.git.4bb45f8.assembly.stream.el7
openshift (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.4c3480d.el7, 4.6.0-202107292126.p0.git.4c3480d.el8, 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7, 4.7.0-202107292242.p0.git.558d959.assembly.stream.el8, 4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7, 4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.6.0-202107292126.p0.git.2b525e8.el7, 4.6.0-202107292126.p0.git.2b525e8.el8, 4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7, 4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8, 4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7, 4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8, 4.8.0-202108120034.p0.git.0d10c3f.assembly.stream.el7, 4.8.0-202108120034.p0.git.0d10c3f.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.6.0-202107291238.p0.git.39cfc66.el8, 4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8, 4.8.0-202107291413.p0.git.39cfc66.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1633555500-1.el8
IBM Qradar SIEM - update to 7.5.0 Update Pack 9 IF01
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210730151213.5b801be.el8
ovn2.13 (Red Hat package) - update to 20.12.0-140.el8fdp
IBM Robotic Process Automation - update to 21.0.3.1
redhat-release-coreos (Red Hat package) - update to 47.84-1.el8
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-4, 2021.3.1
Asset Repository in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-3, 2021.2.1-1
toolbox - update to 0.0.99.5-2.0.1
toolbox-tests - update to 0.0.99.5-2.0.1
udica - update to 0.2.6-21
runc - addressed in versions 1.1.12-1.0.1, 1.1.12-5.0.1
slirp4netns - update to 1.2.3-1
oci-seccomp-bpf-hook - update to 1.2.10-1
containernetworking-plugins - addressed in versions 1.4.0-2.0.1, 1.4.0-5.0.1
Migration Toolkit for Containers - update to 1.5.1
Netcool Operations Insight - update to 1.6.6
skopeo (Red Hat package) - update to 1.9.2-1.el9
aardvark-dns - addressed in versions 1.10.0-2.0.1, 1.10.1-2.0.1
netavark - update to 1.10.3-1.0.1
fuse-overlayfs - update to 1.13-1.0.1
crun - update to 1.14.3-2
skopeo-tests - addressed in versions 1.14.3-2.0.1, 1.14.5-3.0.1
skopeo - addressed in versions 1.14.3-2.0.1, 1.14.5-3.0.1
golang - update to 1.15.7-5
golang-help - update to 1.15.7-5
golang-devel - update to 1.15.7-5
go1.15-race - update to 1.15.13-1.33.1
go1.15-doc - update to 1.15.13-1.33.1
go1.15 - update to 1.15.13-1.33.1
golang - update to 1.15.14-1.el7
go1.16-race - update to 1.16.5-1.17.1
go1.16 - update to 1.16.5-1.17.1
go1.16-doc - update to 1.16.5-1.17.1
buildah (Red Hat package) - update to 1.27.0-2.el9
buildah - addressed in versions 1.33.7-1, 1.33.11-1
buildah-tests - addressed in versions 1.33.7-1, 1.33.11-1
containers-common - addressed in versions 1-81.0.1, 1-82.0.1
go - update to 2
conmon - update to 2.1.10-1
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.2
container-selinux - update to 2.229.0-2
etcd (Red Hat package) - update to 3.3.23-3.1.el8ost.1
crit - update to 3.18-5.0.1
python3-criu - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
libslirp-devel - update to 4.4.0-2
libslirp - update to 4.4.0-2
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.9.0
python3-podman - addressed in versions 4.9.0-1, 4.9.0-3
podman-catatonit - addressed in versions 4.9.4-1.0.1, 4.9.4-18.0.1
podman - addressed in versions 4.9.4-1.0.1, 4.9.4-18.0.1
podman-gvproxy - addressed in versions 4.9.4-1.0.1, 4.9.4-18.0.1
podman-plugins - addressed in versions 4.9.4-1.0.1, 4.9.4-18.0.1
podman-remote - addressed in versions 4.9.4-1.0.1, 4.9.4-18.0.1
podman-tests - addressed in versions 4.9.4-1.0.1, 4.9.4-18.0.1
podman-docker - addressed in versions 4.9.4-1.0.1, 4.9.4-18.0.1
mcg (Red Hat package) - update to 5.9.0-28.61dcf87.5.9.el8
IBM Security Verify Access - update to 10.0.9
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
cockpit-podman - update to 84.1-1

• https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
• https://groups.google.com/g/golang-announce

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization 4.8
• Multiple vulnerabilities in Red Hat OpenShift Virtualization 2.6
• SUSE update for go1.16
• SUSE update for go1.15
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Gentoo update for Go
• Multiple vulnerabilities in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Denial of service in IBM App Connect Enterprise Certified Container
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9 update for skopeo
• Multiple vulnerabilities in Netcool Operations Insight
• Red Hat OpenStack Platform 16 update for etcd
• Red Hat OpenStack Platform 16 update for etcd
• Arch Linux update for go
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM QRadar Suite software
• openEuler update for golang
• Red Hat Enterprise Linux 8 update for the container-tools:3.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Fedora EPEL 7 update for golang
• Multiple vulnerabilities in IBM Security Verify Access
• Anolis OS update for container-tools:an8 module
• Anolis OS update for container-tools:an8 module
• Multiple vulnerabilities in Dell ObjectScale