CVE-2021-34558

 

Published at: - 15-07-2021 04:15

Last modified: - 04-08-2022 10:00

Total changes: - 12

Description

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://groups.google.com/g/golang-announce
• https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ
• https://golang.org/doc/devel/release#go1.16.minor
• FEDORA-2021-1bfb61f77c-Mailing List, Third Party Advisory
• FEDORA-2021-25c0011e78-Mailing List, Third Party Advisory
• FEDORA-2021-47d259d3cf-Mailing List, Third Party Advisory
• FEDORA-2021-3a55403080-Mailing List, Third Party Advisory
• FEDORA-2021-54f88bebd4-Mailing List, Third Party Advisory
• FEDORA-2021-07e4d20196-Mailing List, Third Party Advisory
• FEDORA-2021-6ac9b98f9e-Mailing List, Third Party Advisory
• FEDORA-2021-ffa749f7f7-Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210813-0005/
• FEDORA-2021-c35235c250-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• GLSA-202208-02-Third Party Advisory

 

Keywords

NVD

 

CVE-2021-34558

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures