Bugzilla – Bug 1189162
VUL-0: CVE-2021-36221: go1.16,go1.15: go: net/http: panic due to racy read of persistConn after handler panic
Last modified: 2021-09-10 13:14:47 UTC
A net/http/httputil ReverseProxy can panic due to a race condition if its Handler aborts with ErrAbortHandler, for example due to an error in copying the response body. An attacker might be able to force the conditions leading to the race condition. This is issue https://golang.org/issue/46866 and CVE-2021-36221. Thanks to Andrew Crump (VMware) for reporting this issue.
This is an autogenerated message for OBS integration: This bug (1189162) was mentioned in https://build.opensuse.org/request/show/910390 Factory / go1.15 https://build.opensuse.org/request/show/910391 Factory / go1.16
Thanks Jeff for having reported this issue, could you please also backport the patch to SUSE:SLE-15:Update/go1.15 [0] and SUSE:SLE-15:Update/go1.16 [1]. Thanks [0] https://github.com/golang/go/commit/ba93baa74a52d57ae79313313ea990cc791ef50e [1] https://github.com/golang/go/commit/accf363d5da864521c90b152fb734f3f15e00521
(In reply to Gianluca Gabrielli from comment #2) > Thanks Jeff for having reported this issue, could you please also backport > the patch to SUSE:SLE-15:Update/go1.15 [0] and SUSE:SLE-15:Update/go1.16 > [1]. Thanks These are in now. I submit go releases as MRs to SLE-15:Update and SLE-12:Update ASAP once SRs accepted to openSUSE:Factory staging.
# maintenance_jira_update_notice SUSE-SU-2021:2788-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1182345,1189162 CVE References: CVE-2021-36221 JIRA References: Sources used: SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): go1.16-1.16.7-1.23.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): go1.16-1.16.7-1.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:2788-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1182345,1189162 CVE References: CVE-2021-36221 JIRA References: Sources used: openSUSE Leap 15.3 (src): go1.16-1.16.7-1.23.1
# maintenance_jira_update_notice SUSE-SU-2021:2787-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1175132,1188906,1189162 CVE References: CVE-2021-36221 JIRA References: Sources used: SUSE Manager Server 4.0 (src): go1.15-1.15.15-1.39.1 SUSE Manager Retail Branch Server 4.0 (src): go1.15-1.15.15-1.39.1 SUSE Manager Proxy 4.0 (src): go1.15-1.15.15-1.39.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): go1.15-1.15.15-1.39.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): go1.15-1.15.15-1.39.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): go1.15-1.15.15-1.39.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): go1.15-1.15.15-1.39.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): go1.15-1.15.15-1.39.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): go1.15-1.15.15-1.39.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): go1.15-1.15.15-1.39.1 SUSE Enterprise Storage 6 (src): go1.15-1.15.15-1.39.1 SUSE CaaS Platform 4.0 (src): go1.15-1.15.15-1.39.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:2787-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1175132,1188906,1189162 CVE References: CVE-2021-36221 JIRA References: Sources used: openSUSE Leap 15.3 (src): go1.15-1.15.15-1.39.1
# maintenance_jira_update_notice openSUSE-SU-2021:1199-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1182345,1189162 CVE References: CVE-2021-36221 JIRA References: Sources used: openSUSE Leap 15.2 (src): go1.16-1.16.7-lp152.8.1
# maintenance_jira_update_notice openSUSE-SU-2021:1207-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1175132,1188906,1189162 CVE References: CVE-2021-36221 JIRA References: Sources used: openSUSE Leap 15.2 (src): go1.15-1.15.15-lp152.26.1
released