CVE-2021-33195: 
Jenkins vulnerability analysis and mitigation

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. The vulnerability was discovered and disclosed in June 2021 (Golang Announce).

The vulnerability affects the LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and their respective methods on the Resolver type. These functions may return arbitrary values retrieved from DNS that do not follow the established RFC 1035 rules for domain names. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (NVD).

If the unvalidated DNS responses are used without proper sanitization, particularly when included in HTML content, they could allow for injection of unexpected content. This could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).

Users should upgrade to Go version 1.15.13 or 1.16.5 or later versions which contain the security fix. For systems using Gentoo, users should upgrade to dev-lang/go version 1.18.5 or later (Gentoo Advisory).