Vulnerability Name:

CVE-2021-31525 (CCN-202709)

Assigned:2021-04-22
Published:2021-04-22
Updated:2022-11-09
Summary:net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
CVSS v3 Severity:5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.9 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-674
CWE-120
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-31525

Source: XF
Type: UNKNOWN
golang-cve202131525-dos(202709)

Source: CCN
Type: Go GIT Repository
net/http: ReadRequest can stack overflow due to recursion with very large headers #45710

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://github.com/golang/go/issues/45710

Source: MISC
Type: Mailing List, Third Party Advisory
https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-ee3c072cd0

Source: GENTOO
Type: Third Party Advisory
GLSA-202208-02

Source: CCN
Type: IBM Security Bulletin 6466435 (Spectrum Protect Plus)
Vulnerabilities in Redis, MinIO, Golang, and Urllib3 affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift

Source: CCN
Type: IBM Security Bulletin 6469447 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container Operator may be vulnerable to DoS caused by a flaw in Golang module net/http (CVE-2021-31525)

Source: CCN
Type: IBM Security Bulletin 6475303 (Cloud Pak for Multicloud Management)
A security vulnerability in Golang Go affects IBM Cloud Pak for Multicloud Management Managed services

Source: CCN
Type: IBM Security Bulletin 6483515 (API Connect)
IBM API Connect is impacted by a vulnerability in Golang (CVE-2021-31525)

Source: CCN
Type: IBM Security Bulletin 6486009 (Watson Machine Learning on CP4D)
Golang Go Vulnerability Affects IBM Watson Machine Learning on CP4D (CVE-2021-31525)

Source: CCN
Type: IBM Security Bulletin 6489841 (Cloud Automation Manager)
A security vulnerability in Golang GO affects IBM Cloud Automation Manager

Source: CCN
Type: IBM Security Bulletin 6492207 (Watson Discovery)
IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go

Source: CCN
Type: IBM Security Bulletin 6497349 (Cloud Pak for Integration)
IBM Cloud Pak for Integration is vulnerable to Go vulnerability CVE-2021-31525

Source: CCN
Type: IBM Security Bulletin 6499711 (Cloud Pak for Integration)
Operations Dashboard is vulnerable to multiple Go vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6519392 (Cloud Pak System)
Multiple vulnerabilities have been found in Golang Go which is shipped with Cloud Pak System

Source: CCN
Type: IBM Security Bulletin 6574375 (Cloud Private)
Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-31525)

Source: CCN
Type: IBM Security Bulletin 6599203 (Netezza As A Service)
IBM Netezza as a Service is vulnerable to denial of service due to Golang net package (CVE-2021-33194, CVE-2021-44716, CVE-2021-31525)

Source: CCN
Type: IBM Security Bulletin 6599703 (Db2 On Openshift)
Multiple vulnerabilities affect IBM Db2 On Openshift and IBM Db2 and Db2 Warehouse on Cloud Pak for Data

Source: CCN
Type: IBM Security Bulletin 6606299 (Cloud Pak for Multicloud Management)
IBM Cloud Pak for Multicloud Management Monitoring has multiple vulnerabilities associated with the Go runtime (CVE-2021-29923, CVE-2021-31525, CVE-2021-33194, CVE-2021-33195, CVE-2021-33196, CVE-2021-33197, CVE-2021-33198)

Source: CCN
Type: IBM Security Bulletin 6610915 (Netezza for Cloud Pak for Data)
IBM Netezza for Cloud Pak for Data is vulnerable to denial of service due to Golang net package (CVE-2021-27918, CVE-2021-44716, CVE-2021-31525)

Source: CCN
Type: IBM Security Bulletin 6615221 (Robotic Process Automation for Cloud Pak)
Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Source: CCN
Type: IBM Security Bulletin 6831813 (Netcool Operations Insight)
Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities.

Source: CCN
Type: IBM Security Bulletin 6833266 (CICS TX Standard)
IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go.

Source: CCN
Type: IBM Security Bulletin 6833268 (CICS TX Advanced)
IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Golang Go.

Source: CCN
Type: IBM Security Bulletin 6991617 (Edge Application Manager)
Open Source Dependency Vulnerability

Source: CCN
Type: IBM Security Bulletin 6999559 (Edge Application Manager)
IBM Edge Application Manager 4.5 addresses multiple security vulnerabilities

Source: CCN
Type: IBM Security Bulletin 7002503 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2021-31525

Vulnerable Configuration:Configuration 1:
  • cpe:/a:golang:go:*:*:*:*:*:*:*:* (Version >= 1.16.0 and < 1.16.4)
  • OR cpe:/a:golang:go:*:*:*:*:*:*:*:* (Version < 1.15.12)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:golang:go:1.15.0:-:*:*:*:*:*:*
  • OR cpe:/a:golang:go:1.16.0:-:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:watson_discovery:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:2018.4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_private:3.2.1:cd:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_private:3.2.2:cd:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:watson_discovery:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:2018.4.1.16:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2_warehouse:3.5:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2_warehouse:4.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:3.5:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:4.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cics_tx:11.1:*:*:*:standard:*:*:*
  • OR cpe:/a:ibm:cics_tx:11.1:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:94895
    P
    		fetchmailconf-6.4.22-20.26.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94896
    P
    		file-roller-3.40.0-150400.3.13 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:101609
    P
    		Security update for webkit2gtk3 (Important)
    2022-01-25
    oval:org.opensuse.security:def:101608
    P
    		Security update for expat (Important)
    2022-01-25
    oval:org.opensuse.security:def:112337
    P
    		go1.16-1.16.8-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:112334
    P
    		go1.15-1.15.15-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:105856
    P
    		Security update for binutils (Moderate)
    2021-11-09
    oval:org.opensuse.security:def:105855
    P
    		Security update for binutils (Moderate)
    2021-11-04
    oval:org.opensuse.security:def:4487
    P
    		Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP5) (Important)
    2021-09-16
    oval:org.opensuse.security:def:4486
    P
    		Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP5) (Important)
    2021-09-16
    oval:com.redhat.rhsa:def:20213076
    P
    		RHSA-2021:3076: go-toolset:rhel8 security, bug fix, and enhancement update (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:111450
    P
    		Security update for go1.15 (Moderate)
    2021-06-23
    oval:org.opensuse.security:def:65646
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:74643
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:97120
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:65575
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:117789
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:74644
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:108274
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:97121
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:101783
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:65576
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:4556
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:74713
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:108275
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:101784
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:65645
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:4557
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:74714
    P
    		Security update for go1.16 (Moderate)
    2021-06-18
    oval:org.opensuse.security:def:117788
    P
    		Security update for go1.15 (Moderate)
    2021-06-18
    BACK
    golang go *
    golang go *
    fedoraproject fedora 34
    golang go 1.15.0 -
    golang go 1.16.0 -
    ibm watson discovery 2.0.0
    ibm api connect 2018.4.1.0
    ibm cloud private 3.2.1 cd
    ibm spectrum protect plus 10.1.6
    ibm cloud private 3.2.2 cd
    ibm app connect enterprise certified container 1.0.0
    ibm app connect enterprise certified container 1.0.1
    ibm app connect enterprise certified container 1.0.2
    ibm app connect enterprise certified container 1.0.3
    ibm app connect enterprise certified container 1.0.4
    ibm spectrum protect plus 10.1.7
    ibm watson discovery 2.2.1
    ibm api connect 2018.4.1.16
    ibm spectrum protect plus 10.1.8
    ibm spectrum protect plus 10.1.5
    ibm db2 warehouse 3.5 -
    ibm db2 warehouse 4.0 -
    ibm db2 3.5 -
    ibm db2 4.0 -
    ibm cics tx 11.1
    ibm cics tx 11.1
    ibm robotic process automation for cloud pak 21.0.1
    ibm robotic process automation for cloud pak 21.0.2
    ibm robotic process automation for cloud pak 21.0.3
    ibm cloud pak for security 1.10.0.0