Vulnerability · Published Dec 26, 2022 · Assigned by mitre
CVE-2021-38561
High 7.5
In plain English
A high-severity out-of-bounds read in the git-lfs package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.5%top 25.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | git-lfs | 3.1.2-r3 | ALPINE-CVE-2021-38561 |
| Alpine:v3.21 | git-lfs | 3.1.2-r3 | ALPINE-CVE-2021-38561 |
| Alpine:v3.22 | git-lfs | 3.1.2-r3 | ALPINE-CVE-2021-38561 |
| Alpine:v3.23 | git-lfs | 3.1.2-r3 | ALPINE-CVE-2021-38561 |
| Alpine:v3.24 | git-lfs | 3.1.2-r3 | ALPINE-CVE-2021-38561 |
| Debian:12 | golang-golang-x-text | 0.3.7-1 | DEBIAN-CVE-2021-38561 |
| Debian:13 | golang-golang-x-text | 0.3.7-1 | DEBIAN-CVE-2021-38561 |
| Debian:14 | golang-golang-x-text | 0.3.7-1 | DEBIAN-CVE-2021-38561 |
| Go | golang.org/x/text | 0.3.7 | GO-2021-0113 |
| Go | golang.org/x/text | 0.3.7 | GHSA-ppp9-7jff-5vj2 |
| Ubuntu:22.04:LTS | golang-golang-x-text | 0.3.7-1 | UBUNTU-CVE-2021-38561 |
| Ubuntu:22.04:LTS | golang-golang-x-text | 0.3.7-1ubuntu0.20.04.1 | USN-5873-1 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H