BIT-golang-2021-29923

BIT-golang-2021-29923 PUBLISHED CVSS 7.5 HIGH

Record from OSV · Published March 6, 2024

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
golang	Bitnami	1.17.0

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Vendor	Product	Versions
Bitnami	golang	0

Timeline

Mar 6, 2024 CVE Published
Apr 3, 2025 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln BIT-golang-2021-29923
vulnetix vdb fixes BIT-golang-2021-29923

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/BIT-golang-2021-29923/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →