What’s Vulnerable › Vulnerabilities
CVE-2021-34558
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 7.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-07-15 · updated 2026-06-17
- Weakness: CWE-295
Description
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
Affected products
- Fedoraproject Fedora: 33, 34
- Go: before 1.15.14; from 1.16.0 before 1.16.6 — fixed in 1.15.14, 1.16.6
- NetApp Cloud Insights Telegraf: all versions
- NetApp StorageGRID: all versions
- NetApp Trident: all versions
- Oracle Corporation TimesTen In-Memory Database: before 21.1.1.1.0 — fixed in 21.1.1.1.0
How to fix
Upgrade to a fixed version: Go 1.15.14, 1.16.6; Oracle Corporation TimesTen In-Memory Database 21.1.1.1.0. Check the vendor advisory for mitigations.
References
- https://golang.org/doc/devel/release#go1.16.minor
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BA7MFVXRBEKRTLSLYDICTYCGEMK2HZ7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XBQUFVI5TMV4KMKI7GKA223LHGPQISE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BTC3JQUASFN5U2XA4UZIGAPZQBD5JSS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7FRFM7WWR2JCT6NORQ7AO6B453OMI3I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITRXPCHUCJGXCX2CUEPKZRRTB27GG4ZB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYIUSR4YP52PWG7YE7AA3DZ5OSURNFJB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBMLUQMN6XRKPVOI5XFFBP4XSR7RNTYR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLOGBB7XBBRB3J5FDPW5KWHSH7IRF64W/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXJ2MVMAHOIGRH37ZSFYC4EVWLJFL2EQ/
Get alerted when CVE-2021-34558 or the next vulnerability affects your stack