CVE-2021-34558
published 2021-07-15CVE-2021-34558: The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a…
medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | golang-1.15 | < golang-1.15 1.15.9-6 (bullseye) | golang-1.15 1.15.9-6 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| golang | go | < 1.15.14 | 1.15.14 |
| golang | go | >= 1.16.0 < 1.16.6 | 1.16.6 |
| msrc | cm1_golang_1.16.7-1_on_cbl_mariner_1.0 | — | — |
| oracle | timesten_in-memory_database | < 21.1.1.1.0 | 21.1.1.1.0 |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM