CVE-2021-38561

Published: Dic 26, 2022 Last Modified: Apr 14, 2025 EU-VD ID: EUVD-2022-7707 Aliases: GHSA-ppp9-7jff-5vj2
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0005
Percentile
0,2th
Updated

EPSS Score Trend (Last 90 Days)

125

Out-of-bounds Read

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Availability Other
Potential Impacts:
Read Memory Bypass Protection Mechanism Dos: Crash, Exit, Or Restart Varies By Context
Applicable Platforms
Languages: C, C++, Memory-Unsafe
Technologies: ICS/OT
View CWE Details
Application

Text by Golang

Product Information
Vendor Golang
Product Text
Version Range Affected
To 0.3.7 (exclusive)
cpe:2.3:a:golang:text:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://deps.dev/advisory/OSV/GO-2021-0113
Patch Third Party Advisory
https://deps.dev/advisory/OSV/GO-2021-0113
https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f878…
Mailing List Patch Vendor Advisory
https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
https://groups.google.com/g/golang-announce
Mailing List Third Party Advisory
https://groups.google.com/g/golang-announce
https://pkg.go.dev/golang.org/x/text/language
Product Vendor Advisory
https://pkg.go.dev/golang.org/x/text/language
https://deps.dev/advisory/OSV/GO-2021-0113
Patch Third Party Advisory
https://deps.dev/advisory/OSV/GO-2021-0113
https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f878…
Mailing List Patch Vendor Advisory
https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
https://groups.google.com/g/golang-announce
Mailing List Third Party Advisory
https://groups.google.com/g/golang-announce
https://pkg.go.dev/golang.org/x/text/language
Product Vendor Advisory
https://pkg.go.dev/golang.org/x/text/language