blob: 320a42c785bf8fb9d5356b1121f08066a3d3c2d1 [file] [log] [blame]
packages:
- module: std
package: net
symbols:
- Resolver.LookupAddr
- Resolver.LookupCNAME
- Resolver.LookupMX
- Resolver.LookupNS
- Resolver.LookupSRV
versions:
- fixed: go1.15.13
- introduced: go1.16.0
fixed: go1.16.5
description: |
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr
functions and their respective methods on the Resolver type may
return arbitrary values retrieved from DNS which do not follow
the established RFC 1035 rules for domain names. If these names
are used without further sanitization, for instance unsafely
included in HTML, they may allow for injection of unexpected
content. Note that LookupTXT may still return arbitrary values
that could require sanitization before further use.
published: 2022-02-17T17:33:35Z
cves:
- CVE-2021-33195
credit: Philipp Jeitner and Haya Shulman from Fraunhofer SIT
links:
pr: https://go.dev/cl/320949
commit: https://go.googlesource.com/go/+/c89f1224a544cde464fcb86e78ebb0cc97eedba2
context:
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
- https://go.dev/issue/46241