Published: 15/07/2021 Updated: 07/11/2023

CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 231

Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P

The crypto/tls package of Go up to and including 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Vulnerable Product	Search on Vulmon	Subscribe to Product
golang go
fedoraproject fedora 33
fedoraproject fedora 34
netapp storagegrid -
netapp trident -
netapp cloud insights telegraf -
oracle timesten in-memory database

Synopsis Moderate: Red Hat OpenStack Platform 161 (golang-github-vbatts-tar-split) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for golang-github-vbatts-tar-split is now available for Red HatO ...

Synopsis Moderate: OpenShift Virtualization 485 RPMs security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Virtualization release 485 is now available with updates to packages and images tha ...

Synopsis Moderate: podman security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for podman is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as h ...

Synopsis Moderate: Windows Container Support for Red Hat OpenShift 500 [security update] Type/Severity Security Advisory: Moderate Topic The components for Windows Container Support for Red Hat OpenShift 500 are now available This product release includes bug fixes and a moderate security update for the following packages: windows-machin ...

Synopsis Important: Red Hat OpenShift Data Foundation 4100 enhancement, security & bug fix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixesare now available for Red Hat OpenShift Data Foundation 4100 on Red HatEnterprise Linux 8Red Hat Product Security ...

Synopsis Moderate: Red Hat OpenStack Platform 162 (golang-github-vbatts-tar-split) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for golang-github-vbatts-tar-split is now available for Red HatO ...

Synopsis Moderate: OpenShift Virtualization 4100 Images security and bug fix update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Virtualization release 4100 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a securit ...

A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards connection headers if the first one was empty This flaw allows an attacker to drop arbitrary headers The highest threat from this vulnerability is to integrity (CVE-2021-33197) A flaw was found in Go, where it attempts to allocate excessive memory ...

A vulnerability was found in archive/zip of the Go standard library Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files (CVE-2021-33196) A flaw was found in golang A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, ...

The crypto/tls package of Go through 1165 does not properly assert that the type of public key in an X509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic ...

A security issue has been found in Go before version 1166 crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters net/http clients performing HTTPS requests are also affected The panic can be triggered by an attacker in a privileged network position without access to the server certificate's pri ...

POC for CVE-2021-34558 # Run the malicious TLS server go run maingo -mode server # Run a normal `httpGet` client call against the server which panics go run maingo -mode client There is a minor modification to /vendor/githubcom/refraction-networking/utls/handshake_servergo to enable the malicious handshake to be sent with a mismatc

Get Started

CVE-2021-34558

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect