{"id":100945,"date":"2021-08-08T16:22:46","date_gmt":"2021-08-08T14:22:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov"},"modified":"2021-08-08T16:22:46","modified_gmt":"2021-08-08T14:22:47","slug":"uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","title":{"rendered":"A vulnerability in the network libraries of Rust and Go that allows bypassing IP address checks.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vulnerabilities related to the incorrect handling of IP addresses containing octal digits have been identified in the standard libraries of Rust and Go in address parsing functions. These vulnerabilities allow bypassing valid address checks in applications, for instance, enabling access to loopback interface addresses (127.x.x.x) or intranet subnets during SSRF (Server-side request forgery) attacks. These vulnerabilities continue a cycle of issues previously identified in libraries like node-netmask (JavaScript, CVE-2021-28918, CVE-2021-29418), private-ip (JavaScript, CVE-2020-28360), ipaddress (Python, CVE-2021-29921), Data::Validate::IP (Perl, CVE-2021-29662), and Net::Netmask (Perl, CVE-2021-29424). <\/p>\n

According to the specification, string values (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community.<\/a>Values starting with zero should be interpreted as octal numbers, but many libraries do not account for this peculiarity and simply discard the zero, processing the value as a decimal number. For example, the number 0177 in the octal system equals 127 in the decimal system. An attacker can request a resource by specifying the value «0177.0.0.1», which corresponds to «127.0.0.1» in decimal representation. If a problematic library is used, the application will not recognize the address 0177.0.0.1 as part of the subnet 127.0.0.1\/8, but when sending the request, it may end up actually connecting to the address «0177.0.0.1», which networking functions will process as 127.0.0.1. Similarly, an intranet address check can be circumvented by specifying values like «012.0.0.1» (equivalent to «10.0.0.1»). <\/p>\n

In Rust, the problem affected the standard library «std::net» (CVE-2021-29922). The IP address parser of this library discarded the zero before values in the address, but only if no more than three digits were specified, for example, «0177.0.0.1» would be perceived as an invalid value, while 010.8.8.8 and 127.0.026.1 would return incorrect results. Applications using std::net::IpAddr when parsing user-specified addresses are potentially vulnerable to SSRF (Server-side request forgery), RFI (Remote File Inclusion), and LFI (Local File Inclusion) attacks. The vulnerability was fixed in Rust version 1.53.0.

\"A<\/center> <\/p>\n

In the Go language, the problem affected the standard library «net» (CVE-2021-29923). The built-in fonction net.ParseCIDR skips zeros before octal numbers instead of processing them. For example, an attacker can submit a value of 00000177.0.0.1, which when checked in the function net.ParseCIDR(00000177.0.0.1\/24) will be parsed as 177.0.0.1\/24 rather than 127.0.0.1\/24. This issue also manifests in the Kubernetes platform. The vulnerability was fixed in Go release 1.16.3 and beta version 1.17.

\"A<\/center>
\r\n \"Play\r\n
<\/div>\r\n <\/div><\/center>
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c loopback-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 (127.x.x.x) \u0438\u043b\u0438 \u0438\u043d\u0442\u0440\u0430\u043d\u0435\u0442-\u043f\u043e\u0434\u0441\u0435\u0442\u044f\u043c \u043f\u0440\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0430\u0442\u0430\u043a SSRF (Server-side request forgery). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0446\u0438\u043a\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 node-netmask […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100946,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in the networking libraries of Rust and Go languages allowing IP address validation bypass | ProHoster","description":"Vulnerabilities related to improper handling of IP addresses with octal digits have been identified in the standard libraries of the Rust and Go languages during address parsing functions.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-08T14:22:47+00:00","article:modified_time":"2021-08-08T14:22:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100945","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-08 15:21:11","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=100945"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100945\/revisions"}],"predecessor-version":[{"id":158030,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100945\/revisions\/158030"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/100946"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=100945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=100945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=100945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}