CVE-2021-34558
Medium
Description
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Go
PublishedJul 15, 2021
First seenJul 15, 2021
How to fix
Update
- golang go1.15.14, 1.16.6 or later
- oracle timesten_in-memory_database21.1.1.1.0 or later
- stdlib1.15.14, 1.16.6 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7FRFM7WWR2JCT6NORQ7AO6B453OMI3I/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BA7MFVXRBEKRTLSLYDICTYCGEMK2HZ7/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYIUSR4YP52PWG7YE7AA3DZ5OSURNFJB/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXJ2MVMAHOIGRH37ZSFYC4EVWLJFL2EQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBMLUQMN6XRKPVOI5XFFBP4XSR7RNTYR/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XBQUFVI5TMV4KMKI7GKA223LHGPQISE/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BTC3JQUASFN5U2XA4UZIGAPZQBD5JSS/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITRXPCHUCJGXCX2CUEPKZRRTB27GG4ZB/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLOGBB7XBBRB3J5FDPW5KWHSH7IRF64W/
- security.gentoo.org/glsa/202208-02
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| golang go | v < 1.15.14, 1.16.0 ≤ v < 1.16.6 | 1.15.14, 1.16.6 |
| fedoraproject fedora | 33, 34 | — |
| netapp cloud_insights_telegraf | No range specified | — |
| netapp storagegrid | No range specified | — |
| netapp trident | No range specified | — |
| oracle timesten_in-memory_database | v < 21.1.1.1.0 | 21.1.1.1.0 |
| stdlibGo | v < 1.15.14, 1.16.0-0 ≤ v < 1.16.6 | 1.15.14, 1.16.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.