CVE-2021-38297

Published: 18 October 2021

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Notes

Packages built using golang need to be rebuilt once the
vulnerability has been fixed. This CVE entry does not
list packages that need rebuilding outside of the main
repository or the Ubuntu variants with PPA overlays.

Priority

Medium

CVSS 3 base score: 9.8

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38297
• https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A
• https://github.com/golang/go/issues/48797
• NVD
• Launchpad
• Debian