Back to Database
Status published
High
CVE-2021-41771
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before...
Vulnerability Description
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41771
Credits & Attribution
No credits recorded in the NVD database.
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/
- https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://groups.google.com/g/golang-announce/c/0fM21h43arc
- https://security.netapp.com/advisory/ntap-20211210-0003/
- https://security.gentoo.org/glsa/202208-02
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
- https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
More from golang
View All →CVE-2022-29526
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege...
Medium
5.3
CVE-2022-28327
The generic P-256 feature in crypto/elliptic in Go before 1.17.9...
High
7.5
CVE-2022-27664
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1,...
High
7.5
CVE-2022-27536
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be...
High
7.5
CVE-2022-27191
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker...
High
7.5
Affected Vendor
golang
View all reports →Affected Software
go, fedora, debian linux
Vulnerable Versions:
0, 1.17.0, 34, 35, 9.0
Timeline
Official Publish:
November 8th, 2021
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.