CVE-2021-33197
mediumpriority · track · 22OT risk · elevatedEPSS 0.023 · 83 %ileDEEURUUSEPSS · scored 2026-10-27
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (18)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-0941Red Hat OpenShift: Mehrere SchwachstellenDeutsch2021-08-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um die Integrität und die Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.
- WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
- BIT-golang-2021-331972024-03-06vendor · osvUS
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
- GO-2021-0241Attacker can drop certain headers in net/http/httputil2022-02-17vendor · osvUS
ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202106-1889cnnvd
- EUVD-2021-19910enisa_euvd
- BDU:2022-01781fstec_bdu
- GHSA-wqr7-cf9q-rvf7enisa_euvd
- BIT-golang-2021-33197osv
- GO-2021-0241osv
sources
Which sources assert this record, and when.
references (70)
External citations — patches, advisories, analysis.
- https://groups.google.com/g/golang-announcecnnvd
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSIcnnvd
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI/m/r_EP-NlKBgAJ?pli=1。Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-33197cnnvd
- https://packetstormsecurity.com/files/163764/Red-Hat-Security-Advisory-2021-2984-01.htmlcnnvd
- https://packetstormsecurity.com/files/163805/Red-Hat-Security-Advisory-2021-3009-01.htmlcnnvd
- https://packetstormsecurity.com/files/163957/Red-Hat-Security-Advisory-2021-3361-01.htmlcnnvd
- https://packetstormsecurity.com/files/164004/Red-Hat-Security-Advisory-2021-3248-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan