Search for vulnerabilities
Vulnerability details: VCID-kvq4-bw5a-aaam
Vulnerability ID VCID-kvq4-bw5a-aaam
Aliases CVE-2021-41772
Summary Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-125 Out-of-bounds Read
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2021:5176
rhas Moderate https://access.redhat.com/errata/RHSA-2022:0055
rhas Moderate https://access.redhat.com/errata/RHSA-2022:0056
rhas Moderate https://access.redhat.com/errata/RHSA-2022:1734
rhas Low https://access.redhat.com/errata/RHSA-2022:1745
rhas Low https://access.redhat.com/errata/RHSA-2022:1747
rhas Moderate https://access.redhat.com/errata/RHSA-2022:1819
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41772.json
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00447 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00447 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00447 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
epss 0.00447 https://api.first.org/data/v1/epss?cve=CVE-2021-41772
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=2020736
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2021-41772
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-41772
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-41772
archlinux Low https://security.archlinux.org/AVG-2527
cvssv3.1 5.3 https://security.gentoo.org/glsa/202208-02
generic_textual MODERATE https://security.gentoo.org/glsa/202208-02
cvssv3.1 7.5 https://www.oracle.com/security-alerts/cpujul2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpujul2022.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41772.json
https://api.first.org/data/v1/epss?cve=CVE-2021-41772
https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://groups.google.com/g/golang-announce/c/0fM21h43arc
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/
https://security.gentoo.org/glsa/202208-02
https://security.netapp.com/advisory/ntap-20211210-0003/
https://www.oracle.com/security-alerts/cpujul2022.html
2020736 https://bugzilla.redhat.com/show_bug.cgi?id=2020736
AVG-2527 https://security.archlinux.org/AVG-2527
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:timesten_in-memory_database:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:timesten_in-memory_database:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
CVE-2021-41772 https://nvd.nist.gov/vuln/detail/CVE-2021-41772
RHSA-2021:5176 https://access.redhat.com/errata/RHSA-2021:5176
RHSA-2022:0055 https://access.redhat.com/errata/RHSA-2022:0055
RHSA-2022:0056 https://access.redhat.com/errata/RHSA-2022:0056
RHSA-2022:1734 https://access.redhat.com/errata/RHSA-2022:1734
RHSA-2022:1745 https://access.redhat.com/errata/RHSA-2022:1745
RHSA-2022:1747 https://access.redhat.com/errata/RHSA-2022:1747
RHSA-2022:1819 https://access.redhat.com/errata/RHSA-2022:1819
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41772.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41772
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41772
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41772
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://security.gentoo.org/glsa/202208-02
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.oracle.com/security-alerts/cpujul2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.14119
EPSS Score 0.00055
Published At March 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.