CVE-2021-36221: debian debian_linux

Modified

AliasesMGASA-2021-0416SUSE-SU-2021:2787-1SUSE-SU-2021:2788-1+10 more

Published 08-08-2021Last modified 04-08-2024

Vulnerability summary

CVE-2021-36221 is a medium (CVSS 5.9) vulnerability in debian debian_linux. EPSS estimates a 3.11% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.9/10

010

Medium · v3.1 (NVD)

EPSS score

3.11%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 2

DLA-2891-1 DLA-2892-1 DLA-3395-1 OPENSUSE-SU-2024:10808-1 OPENSUSE-SU-2024:10809-1 RHSA-2021:4156+4 more

Timeline

08-08-2021
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.15.9v2.04.3

EPSS trend

Probability

3.11%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.11% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse13 products

go1.15&distro=SUSE Enterprise Storage 6< 1.15.15-1.39.1
go1.15&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.15.15-1.39.1
go1.15&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.15.15-1.39.1
go1.15&distro=SUSE Linux Enterprise Module for Development Tools 15 SP2< 1.15.15-1.39.1
go1.15&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 1.15.15-1.39.1

Show all 13

Ubuntu7 products

golang-1.10All versions (No fix recorded)
golang-1.13All versions (No fix recorded)
golang-1.14All versions (No fix recorded)
golang-1.16All versions (No fix recorded)
golang-1.6All versions (No fix recorded)

Show all 7

Opensuse4 products

go1.15&distro=openSUSE Leap 15.2< 1.15.15-lp152.26.1
go1.15&distro=openSUSE Leap 15.3< 1.15.15-1.39.1
go1.16&distro=openSUSE Leap 15.2< 1.16.7-lp152.8.1
go1.16&distro=openSUSE Leap 15.3< 1.16.7-1.23.1

Debian2 products

golang-1.15< 1.15.15-1~deb11u1
debian_linuxEOL9.0

Alpine1 product

go≥ 1.16.0, < 1.15.15-r0 | ≥ 1.16.0, < 1.16.7-r0

Fedoraproject1 product

fedoraEOL33 | 34 | 35

Go1 product

stdlib≥ 1.16.0-0, < 1.16.7

Golang1 product

go< 1.15.15 | ≥ 1.16.0, < 1.16.7

Mageia1 product

golang< 1.15.15-1.mga8

Oracle1 product

timesten_in-memory_database< 21.1.1.1.0

Redhat1 product

openshift-serverless-clients< 0:0.25.1-1.el8

Siemens1 product

scalance_lpe9403_firmware< 2.0

12 vendors · 34 products

References

49 links

groups.google.com/forum/
groups.google.com/g/golang-announce/c/JvWG9FUUYT0Mailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
www.oracle.com/security-alerts/cpujan2022.htmlThird Party Advisory
groups.google.com/g/golang-announce/c/uHACNfXAZqkWEBARTICLEMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2022/01/msg00016.htmlMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2022/01/msg00017.htmlMailing ListThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-222547.pdfPatchThird Party Advisory

Show all 49 references

security.gentoo.org/glsa/202208-02Vendor AdvisoryThird Party Advisory
lists.debian.org/debian-lts-announce/2023/04/msg00021.htmlMailing List
advisories.mageia.org/MGASA-2021-0416.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=29391REPORT
lists.suse.com/pipermail/sle-security-updates/2021-August/009314.htmlWEB
lists.suse.com/pipermail/sle-security-updates/2021-August/009321.htmlWEB
lists.opensuse.org/archives/…WEBAdvisory
lists.opensuse.org/archives/…WEBAdvisory
www.suse.com/support/update/announcement/2021/suse-su-20212787-1/Advisory
bugzilla.suse.com/1175132REPORT
bugzilla.suse.com/1188906REPORT
bugzilla.suse.com/1189162REPORT
www.suse.com/security/cve/CVE-2021-36221WEB
www.suse.com/support/update/announcement/2021/suse-su-20212788-1/Advisory
bugzilla.suse.com/1182345REPORT
access.redhat.com/errata/RHSA-2021:4765Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/indexARTICLE
access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/indexARTICLE
access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/indexARTICLE
access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/indexARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1995656REPORT
bugzilla.redhat.com/show_bug.cgi?id=2016255REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4765.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-36221REPORT
www.cve.org/CVERecord?id=CVE-2021-36221AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-36221AdvisoryOval
ubuntu.com/security/CVE-2021-36221REPORT
github.com/golang/go/issues/46866REPORT
github.com/golang/go/commit/b7a85e0003cedb1b48a1fd3ae5b746ec6330102eREPORT
github.com/golang/go/commit/accf363d5da864521c90b152fb734f3f15e00521REPORT
github.com/golang/go/commit/ba93baa74a52d57ae79313313ea990cc791ef50eREPORT
security-tracker.debian.org/tracker/CVE-2021-36221Advisory
go.dev/cl/333191FIX
go.googlesource.com/go/+/b7a85e0003cedb1b48a1fd3ae5b746ec6330102eFIX
go.dev/issue/46866REPORT
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
security.alpinelinux.org/vuln/CVE-2021-36221Advisory