Skip to content
Fencer Vulns
medium 6.5

CVE-2021-3114 json

Incorrect operations on the P-224 curve in crypto/elliptic

published 2021-01-26 5 y ago modified 2026-09-08 2 mo ago also BIT-golang-2021-3114 , EUVD-2021-26466 , GO-2021-0235

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

Patch / fix

  • bitnami golang 1.14.14, 1.15.7
  • go stdlib 1.14.14, 1.15.7
  • golang go 1.14.14, 1.15.7
  • golang-1.15 Debian 11 1.15.7-1

debian advisories DEBIAN-CVE-2021-3114

  • grafana RHEL 8 7.5.9-4.el8
  • runc openshift 4.7 1.0.0-95.rhaos4.8.gitcd80260.el7
  • runc openshift 4.7 1.0.0-95.rhaos4.8.gitcd80260.el8
  • jenkins openshift 4.7 2.277.3.1620393611-1.el8
  • cri-tools openshift 4.7 1.20.0-2.el7
  • cri-tools openshift 4.7 1.20.0-2.el8
  • heketi storage 3.5, storage 3 10.4.0-2.el7rhgs
  • heketi-client storage 3.5, storage 3 10.4.0-2.el7rhgs

red hat advisories RHSA-2021:4226RHSA-2021:1551RHSA-2022:0308RHSA-2021:4103RHSA-2021:2437RHSA-2021:1746

  • go1.15 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +7 more 1.15.7-1.17.1
  • go1.14 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +7 more 1.14.14-1.32.1

suse advisories SUSE-SU-2021:0223-1SUSE-SU-2021:0222-1

  • go1.14 openSUSE Tumbleweed 1.14.15-1.6
  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.14 openSUSE Leap 15.2 1.14.14-lp152.2.18.1
  • go1.15 openSUSE Leap 15.2 1.15.7-lp152.8.1
  • go1.14 openSUSE Leap 15.1 1.14.14-lp151.28.1

opensuse advisories openSUSE-SU-2024:10807-1openSUSE-SU-2024:10808-1openSUSE-SU-2021:0194-1openSUSE-SU-2021:0192-1openSUSE-SU-2021:0190-1

  • grafana AlmaLinux 8 7.5.9-4.el8

almalinux advisories ALSA-2021:4226

  • grafana Rocky Linux 8 7.5.9-4.el8
  • delve Rocky Linux 8 1.5.0-2.module+el8.4.0+396+d2d16ae3
  • golang Rocky Linux 8 1.15.7-1.module+el8.4.0+396+d2d16ae3
  • go-toolset Rocky Linux 8 1.15.7-1.module+el8.4.0+396+d2d16ae3

rocky linux advisories RLSA-2021:4226RLSA-2021:1746

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.15.7-r0

alpine advisories ALPINE-CVE-2021-3114

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.15.7-1

arch linux advisories AVG-1481

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3114 updated cvss 6.5

golang: crypto/elliptic: incorrect operations on the P-224 curve

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9
    affected: no fix available
  • Red Hat OpenShift Service Mesh 1 ior, kiali, servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, +11 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Service Mesh 2.0 kiali, servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, servicemesh-proxy, +8 more
    affected: no fix available
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, prometheus-node-exporter
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 etcd, etcd3, docker, golang, libmpx, podman, +15 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +7 more
    affected: no fix available, no fix planned “Out of support scope”
show 24 more
  • Red Hat OpenShift Container Platform 3.11 apb, cri-o, podman, heapster, cri-tools, prometheus, +61 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +17 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8
    affected: no fix available
  • Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/ocs-rhel8-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 1 virt-api, ember-csi, sriov-cni, multus-cni, kubevirt-cdi, virt-handler, +19 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Virtualization 2 kubevirt, virt-api-container, kubemacpool-container, virt-handler-container, bridge-marker-container, virt-launcher-container, +25 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Storage 3 etcd, golang, grafana, golang-bin, golang-src, golang-misc, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat CNV 2.6 for RHEL 8 container-native-virtualization/vm-import-controller v2.6.6-5, container-native-virtualization/vm-import-controller-rhel8 v2.6.6-5
    fixed: vendor fix RHSA-2021:3119
  • Red Hat CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8 v4.8.0-18
    fixed: vendor fix RHSA-2021:2920
  • Red Hat CNV 4.9 for RHEL 7 kubevirt 4.9.0-287.el7, kubevirt-virtctl 4.9.0-287.el7, kubevirt-virtctl-redistributable 4.9.0-287.el7 Red Hat CNV 4.9 for RHEL 8 kubevirt 4.9.0-287.el8, kubevirt-virtctl 4.9.0-287.el8, kubevirt-virtctl-redistributable 4.9.0-287.el8
    fixed: vendor fix RHSA-2021:4103
  • Red Hat OpenShift Logging 5.0 openshift-logging/elasticsearch-proxy-rhel8 v5.0.2-5, openshift-logging/elasticsearch-rhel8-operator v5.0.2-5, openshift-logging/cluster-logging-rhel8-operator v5.0.2-6
    fixed: vendor fix RHBA-2021:1167
  • Red Hat Openshift Serverless 1.14 openshift-serverless-1/client-kn-rhel8 0.20.0-9, openshift-serverless-1/serving-queue-rhel8 0.20.0-8, openshift-serverless-1/eventing-mtping-rhel8 0.20.0-8, openshift-serverless-1/kourier-control-rhel8 0.20.0-6, openshift-serverless-1/serving-webhook-rhel8 0.20.0-8, openshift-serverless-1/eventing-webhook-rhel8 0.20.0-8, +25 more
    fixed: vendor fix RHSA-2021:1338
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 7.5.9-4.el8, delve 1.5.0-2.module+el8.4.0+8864+58b0fcdb, golang 1.15.7-1.module+el8.4.0+9580+3b0e6c24, go-toolset 1.15.7-1.module+el8.4.0+9580+3b0e6c24, golang-bin 1.15.7-1.module+el8.4.0+9580+3b0e6c24, golang-src 1.15.7-1.module+el8.4.0+9580+3b0e6c24, +3 more
    fixed: vendor fix RHSA-2021:1746
  • Red Hat Gluster Storage Server 3.5 on RHEL-7 heketi 10.4.0-2.el7rhgs, heketi-client 10.4.0-2.el7rhgs, python-heketi 10.4.0-2.el7rhgs, rhgs3/rhgs-gluster-block-prov-rhel7 3.11.8-1
    fixed: vendor fix RHSA-2022:0308
  • Red Hat OpenShift Container Platform 4.6 ignition 2.6.0-7.rhaos4.6.git947598e.el8, ignition-validate 2.6.0-7.rhaos4.6.git947598e.el8
    fixed: vendor fix RHBA-2021:1522
  • Red Hat OpenShift Container Platform 4.7 cri-tools 1.20.0-2.el7, cri-tools 1.20.0-2.el8, jenkins 2.277.3.1620985335-1.el8, runc 1.0.0-95.rhaos4.8.gitcd80260.el7, runc 1.0.0-95.rhaos4.8.gitcd80260.el8, runc 1.0.0-96.rhaos4.8.gitcd80260.el7, +195 more
    fixed: vendor fix RHSA-2021:1006
  • Red Hat OpenShift Container Platform 4.8 ignition 2.9.0-6.rhaos4.8.el8, ignition-validate 2.9.0-6.rhaos4.8.el8, openshift4/ose-cli v4.8.0-202108061927.p0.git.c6ad8ac.assembly.stream, openshift4/ose-pod v4.8.0-202108061527.p0.git.9807387.assembly.stream, openshift4/ose-tests v4.8.0-202108090407.p0.git.89b5077.assembly.stream, openshift4/ose-console v4.8.0-202108090903.p0.git.71e0f84.assembly.stream, +30 more
    fixed: vendor fix RHSA-2021:2437
  • Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-rhel8-operator 5.7.0-69.85e2026.5.7
    fixed: vendor fix RHSA-2021:2041
  • Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel8 1.17.9-7, distributed-tracing/jaeger-query-rhel8 1.17.9-7, distributed-tracing/jaeger-ingester-rhel8 1.17.9-7, distributed-tracing/jaeger-rhel8-operator 1.17.9-7, distributed-tracing/jaeger-collector-rhel8 1.17.9-7, distributed-tracing/jaeger-all-in-one-rhel8 1.17.9-7
    fixed: vendor fix RHSA-2021:2532
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.4-18, distributed-tracing/jaeger-query-rhel8 1.20.4-18, distributed-tracing/jaeger-ingester-rhel8 1.20.4-17, distributed-tracing/jaeger-rhel8-operator 1.20.4-18, distributed-tracing/jaeger-collector-rhel8 1.20.4-18, distributed-tracing/jaeger-all-in-one-rhel8 1.20.4-18
    fixed: vendor fix RHSA-2021:2543
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.20.0-6.el8, openshift-serverless-clients 0.20.0-7.el8
    fixed: vendor fix RHSA-2021:1339
  • Red Hat OpenShift Serverless 1.10 openshift-serverless-1/client-kn-rhel8 0.16.1-4, openshift-serverless-1/serving-queue-rhel8 0.16.0-6, openshift-serverless-1/kourier-control-rhel8 0.16.0-7, openshift-serverless-1/serving-webhook-rhel8 0.16.0-6, openshift-serverless-1/ingress-rhel8-operator 1.10.2-1, openshift-serverless-1/kn-cli-artifacts-rhel8 0.16.1-4, +9 more
    fixed: vendor fix RHSA-2021:2021
  • Red Hat Storage Native Client for Red Hat Enterprise Linux 7 heketi 10.4.0-2.el7rhgs, heketi-client 10.4.0-2.el7rhgs
    fixed: vendor fix RHSA-2022:0308
  • Red Hat CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-node-labeller v2.6.6-4, container-native-virtualization/kubevirt-kvm-info-nfd-plugin v2.6.6-4, container-native-virtualization/kubevirt-cpu-model-nfd-plugin v2.6.6-4 Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.2-6, openshift-logging/kibana6-rhel8 v5.0.2-6, openshift-logging/eventrouter-rhel8 v5.0.2-4, openshift-logging/elasticsearch6-rhel8 v5.0.2-6, openshift-logging/logging-curator5-rhel8 v5.0.2-5, openshift-logging/elasticsearch-operator-bundle v5.0.2-18, +1 more Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, libgcc, libitm, +15 more Red Hat Enterprise Linux 8 cpp, gcc, libgcc, libitm, gcc-c++, libasan, +23 more Red Hat Enterprise Linux 9 grafana, go-toolset, grafana-selinux Red Hat Gluster Storage Server 3.5 on RHEL-7 rhgs3/rhgs-server-rhel7 3.11.8-3, rhgs3/rhgs-volmanager-rhel7 3.11.8-3
    +2 more products
    Red Hat OpenShift Container Platform 4 openshift-eventrouter Red Hat OpenShift Container Platform 4.6 cri-o 1.19.1-16.rhaos4.6.git130633b.el7, cri-o 1.19.1-16.rhaos4.6.git130633b.el8, openshift-kuryr 4.6.0-202105061806.p0.git.74e6cd2.el8, openshift-kuryr-cni 4.6.0-202105061806.p0.git.74e6cd2.el8, openshift-kuryr-common 4.6.0-202105061806.p0.git.74e6cd2.el8, python3-kuryr-kubernetes 4.6.0-202105061806.p0.git.74e6cd2.el8, +1 more
    not affected: vulnerable code not present

6 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.70% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.14.14
>=1.15.0, <1.15.7
1.14.14
1.15.7
go stdlib
<1.14.14
>=1.15.0-0, <1.15.7
1.14.14
1.15.7

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.