Input validation error in Go programming language - CVE-2021-44716

Vulnerability identifier: #VU58824

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-44716

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Go programming language
Amazon Linux AMI
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE CaaS Platform
Fedora
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Anolis OS
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openEuler
containernetworking-plugins (Red Hat package)
runc (Red Hat package)
etcd (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
grafana (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openstack-heat-templates
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
python-oslo-metrics (Red Hat package)
python-autopage (Red Hat package)
python-scciclient (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
console-login-helper-messages (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
openshift-serverless-clients (Red Hat package)
skopeo (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
fuse-overlayfs (Red Hat package)
crun (Red Hat package)
delve
python-Django
golang
golang-help
golang-devel
containers-common (Red Hat package)
golang-race
golang-tests
golang-src
golang-misc
golang-docs
golang-bin
go-toolset
go-toolset-1.16-golang (Red Hat package)
go-toolset-1.16 (Red Hat package)
go1.16
go1.16-doc
go1.16-race
go1.17
go1.17-doc
go1.17-race
buildah (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
haproxy (Red Hat package)
python-debtcollector (Red Hat package)
kata-containers (Red Hat package)
python-osc-lib (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
python-proliantutils (Red Hat package)
ignition (Red Hat package)
ruby2.1-rubygem-puma
rubygem-puma-debugsource
ruby2.1-rubygem-puma-debuginfo
openvswitch2.16 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
python-cachetools (Red Hat package)
python-oslo-context (Red Hat package)
python-stevedore (Red Hat package)
rabbitmq-server
rabbitmq-server-plugins
python-oslo-policy (Red Hat package)
python-cliff (Red Hat package)
python-sushy (Red Hat package)
openstack-murano-engine
openstack-murano-api
openstack-murano-doc
openstack-murano
python-murano
venv-openstack-murano-x86_64
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironicclient (Red Hat package)
python-oslo-utils (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
kubevirt (Red Hat package)
python-oslo-i18n (Red Hat package)
python-ironic-lib (Red Hat package)
rust-afterburn (Red Hat package)
python-pbr (Red Hat package)
mcg (Red Hat package)
grafana-debuginfo
grafana
python-dracclient (Red Hat package)
ardana-cobbler
ardana-ansible
openstack-ironic-python-agent (Red Hat package)
python-oslo-config (Red Hat package)
venv-openstack-heat-x86_64
python-oslo-db (Red Hat package)
openstack-ironic-inspector (Red Hat package)
venv-openstack-horizon-x86_64
venv-openstack-horizon-hpe-x86_64
python-oslo-messaging (Red Hat package)
openstack-ironic (Red Hat package)
ovn21.09 (Red Hat package)
ovn-2021 (Red Hat package)
ovn21.12 (Red Hat package)
redhat-release-coreos (Red Hat package)
Routing Release
Nomad
Red Hat OpenShift Serverless
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat Developer Tools
IBM Cloud Private
IBM CICS TX Advanced
IBM CICS TX Standard
Astronomer with IBM
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
ObjectScale
IBM Watson Machine Learning Accelerator
IBM Cloud Pak for Watson AIOps
Storage Ceph
IBM Netezza for Cloud Pak for Data
Dell PowerProtect Cyber Recovery
Service Telemetry Framework
Consul Enterprise
IBM Cloud Pak for Multicloud Management Monitoring
IBM Netezza Performance Server
Red Hat OpenStack for IBM Power
Red Hat OpenStack
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
App Connect Enterprise Certified Container
Netcool Operations Insight
IBM Cloud Pak for Multicloud Management Security Services
IBM Fusion HCI
QRadar Suite
Splunk Enterprise
IBM Cloud Pak for Multicloud Management
IBM Edge Application Manager
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
OpenShift Serverless Client
IBM DataPower Gateway
IBM Cloud Pak System
Red Hat Gluster Storage Web Administration
Cloudera Data Platform Private Cloud Base for IBM
Brownfield Connectivity - Gateway

Install updates from vendor's website.

Go programming language - addressed in versions 1.16.12, 1.17.5
containernetworking-plugins (Red Hat package) - addressed in versions 0.9.1-1.rhaos4.10.el8, 0.9.1-2.rhaos4.10.el8
Routing Release - update to 0.228.0
Nomad - addressed in versions 1.0.15, 1.1.9, 1.2.3
Astronomer with IBM - update to 1.0.1
Red Hat OpenShift Serverless - update to 1.21.0
runc (Red Hat package) - addressed in versions 1.0.1-3.rhaos4.10.git4144b63.el7, 1.1.0-1.rhaos4.10.el8, 1.1.0-2.rhaos4.10.el8
Consul Enterprise - addressed in versions 1.8.19, 1.9.13, 1.10.6, 1.11.1
QRadar Suite - update to 1.10.17.0
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Cloud Pak System - update to 2.3.3.5
IBM Cloud Private - addressed in versions 3.2.1.2203, 3.2.2.2203
etcd (Red Hat package) - addressed in versions 3.3.23-7.el8ost, 3.3.23-9.el7rhgs
Guardium Data Security Center (GDSC) - update to 3.7.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
OpenShift Virtualization - addressed in versions 4.9.4, 4.10.0, 4.11.0, 4.12.0
Red Hat OpenShift Container Platform - addressed in versions 4.10.3, 4.10.5, 4.12.4
openshift-ansible (Red Hat package) - addressed in versions 4.10.0-202202110258.p0.g25af5a6.assembly.stream.el7, 4.10.0-202203112237.p0.g7ca0181.assembly.stream.el7
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7, 4.10.0-202202160023.p0.gf93da17.assembly.stream.el8, 4.10.0-202203141248.p0.g6db43e2.assembly.stream.el7, 4.10.0-202203141248.p0.g6db43e2.assembly.stream.el8
grafana (Red Hat package) - addressed in versions 5.2.4-5.el7rhgs, 7.3.6-4.el8_4, 7.5.9-5.el8_5
Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.9
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Netezza Performance Server - update to 11.2.2.3
Red Hat OpenStack - update to 16.2
IBM Robotic Process Automation - update to 21.0.3.1
openstack-heat-templates - update to 0.0.0+git.1654529662.75fa04a-3.27.1
toolbox (Red Hat package) - update to 0.0.8-4.rhaos4.10.el8
rust-bootupd (Red Hat package) - update to 0.2.5-3.rhaos4.10.el8
python-oslo-metrics (Red Hat package) - update to 0.3.0-0.20211020174122.43eee50.el8
python-autopage (Red Hat package) - update to 0.4.0-1.el8
python-scciclient (Red Hat package) - update to 0.11.1-0.20211208154124.a84332b.el8
coreos-installer (Red Hat package) - update to 0.12.0-1.rhaos4.10.el8
butane (Red Hat package) - update to 0.14.0-1.rhaos4.10.el8
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.10.el8
python-hardware (Red Hat package) - update to 0.29.0-0.20211122094056.7662a1d.el8
python-openstacksdk (Red Hat package) - update to 0.59.0-0.20211012172340.d0d4d8b.el8
openshift-serverless-clients (Red Hat package) - update to 1.0.0-2.el8
App Connect Enterprise Certified Container - addressed in versions 1.1.9, 4.2.0
skopeo (Red Hat package) - update to 1.2.2-1.rhaos4.10.el8
ObjectScale - update to 1.4.0
python-oslo-upgradecheck (Red Hat package) - update to 1.4.0-0.20211012144915.3ca8698.el8
fuse-overlayfs (Red Hat package) - update to 1.4.0-1.rhaos4.10.el8
crun (Red Hat package) - update to 1.4.2-1.rhaos4.10.el8
Migration Toolkit for Containers - addressed in versions 1.5.4, 1.7.1
delve - update to 1.6.0-1
Netcool Operations Insight - update to 1.6.6
Brownfield Connectivity - Gateway - update to 1.10.1
python-Django - update to 1.11.29-3.42.1
golang - update to 1.15.7-7
golang-help - update to 1.15.7-7
golang-devel - update to 1.15.7-7
containers-common (Red Hat package) - update to 1-16.rhaos4.10.el8
golang-race - update to 1.16.12-1
golang-tests - update to 1.16.12-1
golang-src - update to 1.16.12-1
golang-misc - update to 1.16.12-1
golang-docs - update to 1.16.12-1
golang-bin - update to 1.16.12-1
golang - update to 1.16.12-1
go-toolset - update to 1.16.12-1
go-toolset-1.16-golang (Red Hat package) - update to 1.16.12-1.el7_9
go-toolset-1.16 (Red Hat package) - update to 1.16.12-1.el7_9
golang - addressed in versions 1.16.12-1.fc34, 1.16.12-1.fc35, 1.16.13-2.el7
go1.16 - update to 1.16.12-1.37.2
go1.16-doc - update to 1.16.12-1.37.2
go1.16-race - update to 1.16.12-1.37.2
golang - addressed in versions 1.16.15-1.37, 1.19.3-2
go1.17 - update to 1.17.5-1.14.2
go1.17-doc - update to 1.17.5-1.14.2
go1.17-race - update to 1.17.5-1.14.2
buildah (Red Hat package) - update to 1.19.7-1.el8
OpenShift Serverless Client - update to 1.21.0
cri-tools (Red Hat package) - addressed in versions 1.23.0-1.el7, 1.23.0-1.el8
cri-o (Red Hat package) - addressed in versions 1.23.0-92.rhaos4.10.gitdaab4d1.el7, 1.23.1-9.rhaos4.10.gitbdffb9a.el8
haproxy (Red Hat package) - update to 2.2.19-1.el8
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
python-debtcollector (Red Hat package) - update to 2.3.0-0.20211012161119.0bf5bf5.el8
kata-containers (Red Hat package) - update to 2.3.0-3.el8
IBM Watson Machine Learning Accelerator - update to 2.3.9
python-osc-lib (Red Hat package) - update to 2.4.2-0.20211012163041.415a6c7.el8
python-oslo-service (Red Hat package) - update to 2.6.0-0.20211012154519.091fd65.el8
IBM Fusion HCI - update to 2.7.0
python-tooz (Red Hat package) - update to 2.9.0-0.20211012145018.174065f.el8
python-proliantutils (Red Hat package) - update to 2.12.2-0.20211210161243.500f518.el8
ignition (Red Hat package) - update to 2.13.0-2.rhaos4.10.el8
ruby2.1-rubygem-puma - update to 2.16.0-3.18.1
rubygem-puma-debugsource - update to 2.16.0-3.18.1
ruby2.1-rubygem-puma-debuginfo - update to 2.16.0-3.18.1
openvswitch2.16 (Red Hat package) - update to 2.16.0-33.el8fdp
jenkins (Red Hat package) - update to 2.319.2.1643288987-1.el8
podman (Red Hat package) - update to 3.0.1-7.rhaos4.10.el8
python-sushy-oem-idrac (Red Hat package) - update to 3.0.2-0.20211011174039.9733d23.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 3.1.0-0.20211130174057.d25ba32.el8
python-cachetools (Red Hat package) - update to 3.1.0-2.el8ost
python-oslo-context (Red Hat package) - update to 3.3.1-0.20211012152439.641a1e0.el8
python-stevedore (Red Hat package) - update to 3.4.0-0.20211012153718.8846a3f.el8
rabbitmq-server - update to 3.6.16-3.13.1
rabbitmq-server-plugins - update to 3.6.16-3.13.1
python-oslo-policy (Red Hat package) - update to 3.8.2-0.20211012161944.c7fd9f4.el8
python-cliff (Red Hat package) - update to 3.9.0-0.20211020191737.734bc0c.el8
python-sushy (Red Hat package) - update to 4.0.0-0.20211209155954.45d24d4.el8
openstack-murano-engine - update to 4.0.2~dev3-3.12.1
openstack-murano-api - update to 4.0.2~dev3-3.12.1
openstack-murano-doc - update to 4.0.2~dev3-3.12.1
openstack-murano - update to 4.0.2~dev3-3.12.1
python-murano - update to 4.0.2~dev3-3.12.1
venv-openstack-murano-x86_64 - update to 4.0.2~dev3-12.38.1
python-oslo-serialization (Red Hat package) - update to 4.2.0-0.20211012151454.2b94a4f.el8
IBM Cloud Pak for Watson AIOps - update to 4.4.0
python-keystoneauth1 (Red Hat package) - update to 4.4.0-0.20211012144044.112bcae.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.1-0.20211012150632.8e08400.el8
python-oslo-log (Red Hat package) - update to 4.6.0-0.20211012154701.41c8807.el8
python-ironicclient (Red Hat package) - update to 4.9.0-0.20211209154934.6f1be06.el8
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.10.0
python-oslo-utils (Red Hat package) - update to 4.10.0-0.20211012164840.2c74bb9.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.10.0-202202160023.p0.g39cfc66.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.10.0-202202160023.p0.ge77f917.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7, 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.10.1643404185-1.el8
kubevirt (Red Hat package) - addressed in versions 4.12.0-1057.el7, 4.12.0-1057.el8
python-oslo-i18n (Red Hat package) - update to 5.1.0-0.20211012165753.b031d17.el8
python-ironic-lib (Red Hat package) - update to 5.1.0-0.20211209154936.731e2f9.el8
rust-afterburn (Red Hat package) - update to 5.2.0-1.rhaos4.10.el8
python-pbr (Red Hat package) - update to 5.5.1-1.el8ost
mcg (Red Hat package) - update to 5.10.0-72.el8
grafana-debuginfo - update to 6.7.4-4.23.1
grafana - update to 6.7.4-4.23.1
python-dracclient (Red Hat package) - update to 7.0.0-0.20211012182751.d26664e.el8
Storage Ceph - update to 7.1
grafana - update to 7.5.9-5.0.1
grafana - addressed in versions 7.5.11-3.fc34, 7.5.11-3.fc35
ardana-cobbler - update to 8.0+git.1660773402.d845a45-3.47.1
ardana-ansible - update to 8.0+git.1660773729.3789a6d-3.85.1
openstack-ironic-python-agent (Red Hat package) - update to 8.3.1-0.20220105174059.d2d3cd6.el8
python-oslo-config (Red Hat package) - update to 8.7.1-0.20211012155707.1a7bd66.el8
venv-openstack-heat-x86_64 - update to 9.0.8~dev22-12.45.1
python-oslo-db (Red Hat package) - update to 9.1.0-0.20211020204148.be2cc6a.el8
IBM DataPower Gateway - addressed in versions 10.0.1.6, 10.0.4.0sr1, 10.5.0.0
openstack-ironic-inspector (Red Hat package) - update to 10.9.1-0.20220117094044.19e2592.el8
IBM CICS TX Advanced - update to 11.1.0.0 ifix5
IBM CICS TX Standard - update to 11.1.0.0 ifix5
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
venv-openstack-horizon-x86_64 - update to 12.0.5~dev6-14.48.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.48.1
python-oslo-messaging (Red Hat package) - update to 12.9.1-0.20211020204149.f9de265.el8
openstack-ironic (Red Hat package) - update to 19.0.1-0.20220120204037.438b8af.el8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
ovn21.09 (Red Hat package) - update to 21.09.0-22.el8fdp
ovn-2021 (Red Hat package) - update to 21.12.0-15.el8fdp
ovn21.12 (Red Hat package) - update to 21.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 410.84-2.el8

• https://github.com/golang/go/issues/50058

• Denial of service in Go
• Denial of service in routing-release
• consul update for Go
• Multiple vulnerabilities in nomad
• Red Hat Developer Tools update for go-toolset-1.16 and go-toolset-1.16-golang
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 8.4 update for grafana
• Red Hat OpenStack Platform 16 update for etcd
• Red Hat OpenStack Platform 16 update for etcd
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Improper input validation in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Serverless
• IBM Cloud Private update for Golang
• Red Hat Gluster Storage Web Administration update for golang
• SUSE update for go1.16
• SUSE update for go1.17
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Gentoo update for Go
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Virtualization 4.9
• Multiple vulnerabilities in OpenShift Virtualization
• SUSE update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma
• Multiple vulnerabilities in IBM Netezza as a Service
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Siemens Brownfield Connectivity Gateway
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Storage Fusion
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• openEuler update for golang
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Storage Ceph
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in OpenShift Serverless Client 1.21
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.10
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.10
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in Migration Toolkit for Containers 1.7
• Fedora 34 update for golang
• Fedora 35 update for golang
• Fedora 35 update for grafana
• Fedora 34 update for grafana
• Fedora EPEL 7 update for golang
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• IBM App Connect Enterprise Certified Container Operator and IntegrationServer update for Golang Go
• Multiple vulnerabilities in IBM DataPower Gateway
• Anolis OS update for go-toolset:an8 module
• Anolis OS update for grafana
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Astronomer with IBM
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Cloudera Data Platform Private Cloud Base with IBM (CDP) update for golang's net/http library