Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-08-07T16:38:59

Updated: 2024-08-03T22:18:03.455Z

Reserved: 2021-04-01T00:00:00

Link: CVE-2021-29923

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-08-07T17:15:07.067

Modified: 2023-11-07T03:32:45.383

Link: CVE-2021-29923

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-03-22T00:00:00Z

Links: CVE-2021-29923 - Bugzilla