CVE-2021-33197

Description

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.04%• Percentile: 12%

Techniques & Countermeasures

• CWE-862•Missing Authorization

  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

• golang•go

  < 1.15.13 | ≥ 1.16.0, < 1.16.5

• Go•stdlib

  ≥ 1.16.0-0, < 1.16.5

References (6)

• https://groups.google.com/g/golang-announce
• https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
• https://security.gentoo.org/glsa/202208-02
• https://go.dev/cl/321929
• https://go.googlesource.com/go/+/950fa11c4cb01a145bb07eeb167d90a1846061b3
• https://go.dev/issue/46313