CVE-2021-33194 (High) detected in github.com/golang/net-ab34263943818b32f575efc978a3d24e80b04bd7
mend-for-github-com opened this issue · comments
mend-for-github-com commented
CVE-2021-33194 - High Severity Vulnerability
Vulnerable Library - github.com/golang/net-ab34263943818b32f575efc978a3d24e80b04bd7
[mirror] Go supplementary network libraries
Dependency Hierarchy:
- github.com/shurcool/githubv4-bbc966b061dd4a1fc13fd74ac2c114c928f8c88a (Root Library)
- github.com/golang/oauth2-c57b0facaced709681d9f90397429b9430a74754
- ❌ github.com/golang/net-ab34263943818b32f575efc978a3d24e80b04bd7 (Vulnerable Library)
- github.com/golang/oauth2-c57b0facaced709681d9f90397429b9430a74754
Found in HEAD commit: bcf55cf041d1ff6dc064426120bf1fca4c9a05de
Found in base branch: trunk
Vulnerability Details
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
Publish Date: 2021-05-26
URL: CVE-2021-33194
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194
Release Date: 2021-05-26
Fix Resolution: golang.org/x/net - v0.0.0-20210520170846-37e1c6afe023