CVE-2021-34558 : The crypto/tls package of Go through 1.16.5 does not properly assert that the ty

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Published 2021-07-15 14:15:20

Updated 2022-08-04 20:00:23

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2021-34558

Oracle » Timesten In-memory Database
Versions before (<) 21.1.1.1.0
cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Netapp » Storagegrid » Version: N/A
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
Matching versions
Netapp » Trident » Version: N/A
cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:*
Matching versions
Netapp » Cloud Insights Telegraf » Version: N/A
cpe:2.3:a:netapp:cloud_insights_telegraf:-:*:*:*:*:*:*:*
Matching versions
Golang » GO
Versions before (<) 1.15.14
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Matching versions
Golang » GO
Versions from including (>=) 1.16.0 and before (<) 1.16.6
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-34558

EPSS FAQ

0.34%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-34558

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.6	LOW	AV:N/AC:H/Au:N/C:N/I:N/A:P	4.9	2.9	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-34558

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-34558

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBMLUQMN6XRKPVOI5XFFBP4XSR7RNTYR/

[SECURITY] Fedora 33 Update: podman-3.2.3-2.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLOGBB7XBBRB3J5FDPW5KWHSH7IRF64W/

[SECURITY] Fedora 34 Update: grafana-7.5.10-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html

Oracle Critical Patch Update Advisory - January 2022
Patch;Third Party Advisory

CVEs referencing this url
https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ

[security] Go 1.16.6 and Go 1.15.14 are released
Mailing List;Release Notes;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D7FRFM7WWR2JCT6NORQ7AO6B453OMI3I/

[SECURITY] Fedora 34 Update: golang-1.16.6-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JYIUSR4YP52PWG7YE7AA3DZ5OSURNFJB/

[SECURITY] Fedora 34 Update: podman-3.2.3-2.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://groups.google.com/g/golang-announce

golang-announce - Google Groups
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BTC3JQUASFN5U2XA4UZIGAPZQBD5JSS/

[SECURITY] Fedora 33 Update: buildah-1.21.4-5.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://security.gentoo.org/glsa/202208-02

Go: Multiple Vulnerabilities (GLSA 202208-02) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WXJ2MVMAHOIGRH37ZSFYC4EVWLJFL2EQ/

[SECURITY] Fedora 34 Update: buildah-1.21.4-5.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://security.netapp.com/advisory/ntap-20210813-0005/

CVE-2021-34558 Golang Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://golang.org/doc/devel/release#go1.16.minor

Release History - The Go Programming Language
Release Notes;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3BA7MFVXRBEKRTLSLYDICTYCGEMK2HZ7/

[SECURITY] Fedora 33 Update: golang-1.15.14-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Oracle Critical Patch Update Advisory - October 2021
Patch;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRXPCHUCJGXCX2CUEPKZRRTB27GG4ZB/

[SECURITY] Fedora 33 Update: containernetworking-plugins-1.0.0-0.3.rc1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3XBQUFVI5TMV4KMKI7GKA223LHGPQISE/

[SECURITY] Fedora 34 Update: containernetworking-plugins-1.0.0-0.3.rc1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-34558

Products affected by CVE-2021-34558

Exploit prediction scoring system (EPSS) score for CVE-2021-34558

CVSS scores for CVE-2021-34558

CWE ids for CVE-2021-34558

References for CVE-2021-34558