Skip to content
Fencer Vulns
high 7.3

CVE-2021-33195 json

Improper sanitization when resolving values from DNS in net

published 2021-08-02 5 y ago modified 2026-09-08 2 mo ago also BIT-golang-2021-33195 , EUVD-2021-19908 , GO-2021-0239

cvss
7.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

Patch / fix

  • bitnami golang 1.15.13, 1.16.5
  • go stdlib 1.15.13, 1.16.5
  • golang go 1.15.13, 1.16.5
  • golang-1.15 Debian 11 1.15.9-5

debian advisories DEBIAN-CVE-2021-33195

  • delve RHEL 8 1.6.0-1.module+el8.5.0+10379+d6b83bd0
  • golang RHEL 8 1.16.7-1.module+el8.5.0+12246+1aac4e3f
  • go-toolset RHEL 8 1.16.7-1.module+el8.5.0+12246+1aac4e3f
  • golang-bin RHEL 8 1.16.7-1.module+el8.5.0+12246+1aac4e3f
  • golang-src RHEL 8 1.16.7-1.module+el8.5.0+12246+1aac4e3f
  • golang-misc RHEL 8 1.16.7-1.module+el8.5.0+12246+1aac4e3f
  • golang-race RHEL 8 1.16.7-1.module+el8.5.0+12246+1aac4e3f
  • golang-tests RHEL 8 1.16.7-1.module+el8.5.0+12246+1aac4e3f

red hat advisories RHSA-2021:4156RHSA-2022:8008RHSA-2021:3555RHSA-2021:3431RHSA-2021:2984RHSA-2022:1402

  • go1.15 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +8 more 1.15.13-1.33.1
  • go1.16 SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2 1.16.5-1.17.1

suse advisories SUSE-SU-2021:2214-1SUSE-SU-2021:2186-1

  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.16 openSUSE Tumbleweed 1.16.8-1.1
  • go1.15 openSUSE Leap 15.2 1.15.13-lp152.20.1
  • go1.15 openSUSE Leap 15.3 1.15.13-1.33.1
  • go1.16 openSUSE Leap 15.3 1.16.5-1.17.1

opensuse advisories openSUSE-SU-2024:10808-1openSUSE-SU-2024:10809-1openSUSE-SU-2021:0950-1openSUSE-SU-2021:2214-1openSUSE-SU-2021:2186-1

  • buildah AlmaLinux 9 1:1.27.0-2.el9
  • buildah-tests AlmaLinux 9 1:1.27.0-2.el9
  • grafana AlmaLinux 8 7.5.9-4.el8
  • delve AlmaLinux 8 1.6.0-1.module_el8.5.0+2604+960c7771

almalinux advisories ALSA-2022:8008ALSA-2021:4226ALSA-2021:4156

  • grafana Rocky Linux 8 7.5.9-4.el8
  • delve Rocky Linux 8 1.6.0-1.module+el8.5.0+694+f77f0bfd
  • golang Rocky Linux 8 1.16.7-1.module+el8.5.0+694+f77f0bfd
  • go-toolset Rocky Linux 8 1.16.7-1.module+el8.5.0+694+f77f0bfd

rocky linux advisories RLSA-2021:4226RLSA-2021:4156

  • go Alpine 3.13 1.15.13-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.16.5-r0

alpine advisories ALPINE-CVE-2021-33195

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.16.5-1

arch linux advisories AVG-2006

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-33195 updated cvss 7.5

golang: net: lookup functions may return invalid host names

  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-operator, +4 more
    affected: no fix available
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter Red Hat Enterprise Linux 7 golang, buildah, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 buildah, buildah-tests Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +4 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8 Red Hat OpenShift Virtualization 2 node-maintenance-operator-container Red Hat OpenShift Virtualization 4 container-native-virtualization/cnv-must-gather-rhel8, container-native-virtualization/node-maintenance-operator, container-native-virtualization/vm-import-controller-rhel8, container-native-virtualization/kubevirt-template-validator
    affected: no fix available
  • Red Hat OpenStack Platform 16.1 golang-qpid-apache Red Hat OpenStack Platform 16.2 golang-qpid-apache
    affected: no fix planned “Will not fix”
  • Red Hat Storage 3 etcd, golang, heketi, grafana, golang-bin, golang-src, +5 more
    affected: no fix planned “Out of support scope”
  • Red Hat Service Telemetry Framework 1.2 for RHEL 8 smart-gateway-container Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8
    affected: no fix planned “Will not fix”
show 19 more
  • Red Hat CNV 2.6 for RHEL 7 kubevirt 2.6.10-230.el7, kubevirt-virtctl 2.6.10-230.el7, kubevirt-virtctl-redistributable 2.6.10-230.el7 Red Hat CNV 2.6 for RHEL 8 kubevirt 2.6.10-230.el8, kubevirt-virtctl 2.6.10-230.el8, kubevirt-virtctl-redistributable 2.6.10-230.el8
    fixed: vendor fix RHSA-2022:1402
  • Red Hat CNV 4.8 for RHEL 7 kubevirt 4.8.5-278.el7, kubevirt-virtctl 4.8.5-278.el7, kubevirt-virtctl-redistributable 4.8.5-278.el7 Red Hat CNV 4.8 for RHEL 8 kubevirt 4.8.5-278.el8, kubevirt-virtctl 4.8.5-278.el8, kubevirt-virtctl-redistributable 4.8.5-278.el8, container-native-virtualization/vm-import-operator-rhel8 v4.8.2-4
    fixed: vendor fix RHSA-2022:1329
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/kubemacpool v4.9.0-19, container-native-virtualization/virt-cdi-cloner v4.9.0-37, container-native-virtualization/virt-cdi-importer v4.9.2-8, container-native-virtualization/virt-cdi-operator v4.9.0-37, container-native-virtualization/virt-cdi-apiserver v4.9.0-37, container-native-virtualization/virt-cdi-controller v4.9.0-37, +3 more
    fixed: vendor fix RHSA-2021:4104
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.15-golang 1.15.14-2.el7_9, go-toolset-1.15-golang-bin 1.15.14-2.el7_9, go-toolset-1.15-golang-src 1.15.14-2.el7_9, go-toolset-1.15-golang-misc 1.15.14-2.el7_9, go-toolset-1.15-golang-race 1.15.14-2.el7_9, go-toolset-1.15-golang-tests 1.15.14-2.el7_9 Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.15-golang 1.15.14-2.el7_9, go-toolset-1.15-golang-bin 1.15.14-2.el7_9, go-toolset-1.15-golang-src 1.15.14-2.el7_9, go-toolset-1.15-golang-misc 1.15.14-2.el7_9, go-toolset-1.15-golang-race 1.15.14-2.el7_9, go-toolset-1.15-golang-tests 1.15.14-2.el7_9
    fixed: vendor fix RHSA-2021:3431
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 7.5.9-4.el8, delve 1.6.0-1.module+el8.5.0+10379+d6b83bd0, golang 1.16.7-1.module+el8.5.0+12246+1aac4e3f, go-toolset 1.16.7-1.module+el8.5.0+12246+1aac4e3f, golang-bin 1.16.7-1.module+el8.5.0+12246+1aac4e3f, golang-src 1.16.7-1.module+el8.5.0+12246+1aac4e3f, +3 more
    fixed: vendor fix RHSA-2021:4156
  • Red Hat Enterprise Linux AppStream (v. 9) buildah 1.27.0-2.el9, buildah-tests 1.27.0-2.el9
    fixed: vendor fix RHSA-2022:8008
  • Red Hat Migration Toolkit 1.5 rhmtc/openshift-velero-plugin-rhel8 v1.5.1-4, rhmtc/openshift-migration-velero-rhel8 v1.5.1-4, rhmtc/openshift-migration-registry-rhel8 v1.5.1-4, rhmtc/openshift-migration-must-gather-rhel8 v1.5.1-3, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 v1.5.1-4
    fixed: vendor fix RHSA-2021:3361
  • Red Hat OpenShift Container Platform 4.6 ignition 2.6.0-8.rhaos4.6.git947598e.el8, ignition-validate 2.6.0-8.rhaos4.6.git947598e.el8
    fixed: vendor fix RHSA-2021:3009
  • Red Hat OpenShift Container Platform 4.7 redhat-release-coreos 47.84-1.el8, cri-o 1.20.4-7.rhaos4.7.git6287500.el7, cri-o 1.20.4-7.rhaos4.7.git6287500.el8, ignition 2.9.0-4.rhaos4.7.git1d56dc8.el8, ignition-validate 2.9.0-4.rhaos4.7.git1d56dc8.el8, openshift 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7, +8 more
    fixed: vendor fix RHBA-2021:2979
  • Red Hat OpenShift Container Platform 4.8 cri-tools 1.21.0-3.el8, butane 0.12.1-2.rhaos4.8.el8, ignition 2.9.0-7.rhaos4.8.el8, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-validate 2.9.0-7.rhaos4.8.el8, +138 more
    fixed: vendor fix RHSA-2021:3248
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-etcd v4.9.0-202109302317.p0.git.5c1feaf.assembly.stream
    fixed: vendor fix RHSA-2021:3759
  • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-rhel8-operator 5.0.0-5, openshift4-wincw/windows-machine-config-operator-bundle v5.0.0-5
    fixed: vendor fix RHSA-2022:0577
  • Red Hat OpenShift Data Foundation 4.9 on RHEL-8 mcg 5.9.0-28.61dcf87.5.9.el8, odf4/ocs-operator-bundle 4.9.0-5, odf4/odf-operator-bundle 4.9.0-5, odf4/odr-hub-operator-bundle 4.9.0-5, odf4/odr-cluster-operator-bundle 4.9.0-5, odf4/odf-multicluster-operator-bundle 4.9.0-5, +10 more
    fixed: vendor fix RHSA-2021:5085
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.5-6, distributed-tracing/jaeger-query-rhel8 1.20.5-3, distributed-tracing/jaeger-ingester-rhel8 1.20.5-6, distributed-tracing/jaeger-rhel8-operator 1.20.5-5, distributed-tracing/jaeger-collector-rhel8 1.20.5-5, distributed-tracing/jaeger-all-in-one-rhel8 1.20.5-3
    fixed: vendor fix RHSA-2021:3229
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.23.2-1.el8
    fixed: vendor fix RHSA-2021:3555
  • Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8 0.23.2-2, openshift-serverless-1/serving-queue-rhel8 0.23.1-2, openshift-serverless-1/eventing-mtping-rhel8 0.23.0-5, openshift-serverless-1/kourier-control-rhel8 0.23.0-4, openshift-serverless-1/serving-webhook-rhel8 0.23.1-2, openshift-serverless-1/eventing-webhook-rhel8 0.23.0-5, +24 more
    fixed: vendor fix RHSA-2021:3556
  • Red Hat OpenStack Platform 16.1 etcd 3.3.23-3.1.el8ost.1
    fixed: vendor fix RHSA-2021:5072
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-3.1.el8ost.1
    fixed: vendor fix RHSA-2021:3487
  • Red Hat RHACS 3.64 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator 3.64.0-2
    fixed: vendor fix RHSA-2021:3146

17 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.20% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • groups.google.com https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.15.13
>=1.16.0, <1.16.5
1.15.13
1.16.5
go stdlib
<1.15.13
>=1.16.0-0, <1.16.5
1.15.13
1.16.5

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.