Skip to content
Fencer Vulns
medium 6.5

CVE-2021-34558 json

Panic on certain certificates in crypto/tls

published 2021-07-15 5 y ago modified 2026-09-08 2 mo ago also BIT-golang-2021-34558 , EUVD-2021-21208 , GO-2021-0243

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.0%
EPSS 7.0% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Patch / fix

  • bitnami golang 1.15.14, 1.16.6
  • go stdlib 1.15.14, 1.16.6
  • golang go 1.15.14, 1.16.6
  • oracle timesten_in-memory_database 21.1.1.1.0
  • golang-1.15 Debian 11 1.15.9-6

debian advisories DEBIAN-CVE-2021-34558

  • crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
  • runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
  • udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
  • podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
  • skopeo RHEL 8 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c

red hat advisories RHSA-2024:2988RHSA-2021:3076RHSA-2022:7954RHSA-2022:0988RHSA-2022:0998RHSA-2022:0260

  • go1.15 SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2 1.15.14-1.36.1
  • go1.16 SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2 1.16.6-1.20.1

suse advisories SUSE-SU-2021:2398-1SUSE-SU-2021:2392-1

  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.16 openSUSE Tumbleweed 1.16.8-1.1
  • go1.15 openSUSE Leap 15.2 1.15.14-lp152.23.1
  • go1.16 openSUSE Leap 15.2 1.16.6-lp152.5.1
  • go1.15 openSUSE Leap 15.3 1.15.14-1.36.1
  • go1.16 openSUSE Leap 15.3 1.16.6-1.20.1

opensuse advisories openSUSE-SU-2024:10808-1openSUSE-SU-2024:10809-1openSUSE-SU-2021:1079-1openSUSE-SU-2021:1078-1openSUSE-SU-2021:2398-1openSUSE-SU-2021:2392-1

  • podman AlmaLinux 9 2:4.2.0-3.el9
  • podman-tests AlmaLinux 9 2:4.2.0-3.el9
  • podman-docker AlmaLinux 9 2:4.2.0-3.el9
  • podman-remote AlmaLinux 9 2:4.2.0-3.el9
  • podman-gvproxy AlmaLinux 9 2:4.2.0-3.el9
  • podman-plugins AlmaLinux 9 2:4.2.0-3.el9
  • grafana AlmaLinux 8 7.5.9-4.el8

almalinux advisories ALSA-2022:7954ALSA-2021:4226

  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1825+623b0c20
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1843+6892ab28
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1872+2e18eb19
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1874+ce489889
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1880+8e896d1b
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1896+b18fa106
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1948+4b5cd4a9

rocky linux advisories RLSA-2024:2988RLSA-2021:4226RLSA-2021:3076

  • go Alpine 3.13 1.15.14-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.16.6-r0

alpine advisories ALPINE-CVE-2021-34558

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.16.6-1

arch linux advisories AVG-2147

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-34558 updated cvss 6.5

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

  • Red Hat OpenShift Pipelines golang Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 golang
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 hive, thanos, grafana, oauth-proxy, rcm-controller, observability-e2e-test, +1 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src Red Hat Enterprise Linux 7 golang, podman, buildah, golang-bin, golang-src, golang-misc, +1 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 runc, podman, skopeo, buildah, podman-tests, skopeo-tests, +8 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 runc, skopeo, buildah, skopeo-tests, buildah-tests
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +3 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8, ocs4/rook-ceph-rhel8-operator Red Hat OpenShift GitOps golang
    affected: workaround, no fix available
show 21 more
  • Red Hat OpenShift Virtualization 2 virt-api-container, kubemacpool-container, virt-handler-container, bridge-marker-container, virt-launcher-container, virt-operator-container, +23 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Virtualization 4 oadp/oadp-kubevirt-velero-plugin-rhel9, container-native-virtualization/virt-api, container-native-virtualization/kubemacpool, container-native-virtualization/virt-handler, container-native-virtualization/bridge-marker, container-native-virtualization/virt-launcher, +14 more Red Hat OpenStack Platform 16.1 golang-golangorg-crypto-devel Red Hat OpenStack Platform 16.2 golang-golangorg-crypto-devel
    affected: workaround, no fix available
  • Red Hat Storage 3 etcd, golang, heketi, grafana, golang-bin, golang-src, +5 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Service Telemetry Framework 1.2 for RHEL 8 stf/sg-core-rhel8, smart-gateway-container
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CNV 2.6 for RHEL 7 kubevirt 2.6.8-211.el7, kubevirt-virtctl 2.6.8-211.el7, kubevirt-virtctl-redistributable 2.6.8-211.el7 Red Hat CNV 2.6 for RHEL 8 kubevirt 2.6.8-211.el8, kubevirt-virtctl 2.6.8-211.el8, kubevirt-virtctl-redistributable 2.6.8-211.el8, container-native-virtualization/vm-import-controller v2.6.7-5, container-native-virtualization/kubevirt-cpu-node-labeller v2.6.7-1, container-native-virtualization/vm-import-controller-rhel8 v2.6.7-5, +2 more
    fixed: vendor fix RHSA-2021:4722
  • Red Hat CNV 4.8 for RHEL 7 kubevirt 4.8.5-278.el7, kubevirt-virtctl 4.8.5-278.el7, kubevirt-virtctl-redistributable 4.8.5-278.el7 Red Hat CNV 4.8 for RHEL 8 kubevirt 4.8.5-278.el8, kubevirt-virtctl 4.8.5-278.el8, kubevirt-virtctl-redistributable 4.8.5-278.el8, container-native-virtualization/vm-import-operator-rhel8 v4.8.2-4
    fixed: vendor fix RHSA-2022:1329
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-cdi-cloner v4.9.0-37, container-native-virtualization/virt-cdi-importer v4.9.2-8, container-native-virtualization/virt-cdi-operator v4.9.0-37, container-native-virtualization/virt-cdi-apiserver v4.9.0-37, container-native-virtualization/virt-cdi-controller v4.9.0-37, container-native-virtualization/virt-cdi-uploadproxy v4.9.0-37, +3 more
    fixed: vendor fix RHSA-2021:4104
  • Red Hat OpenShift Sandboxed Containers 1.1.0 openshift-sandboxed-containers-tech-preview/osc-rhel8-operator 1.1.0-3
    fixed: vendor fix RHEA-2021:3941
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.15 1.15.14-1.el7_9, go-toolset-1.15-build 1.15.14-1.el7_9, go-toolset-1.15-golang 1.15.14-1.el7_9, go-toolset-1.15-runtime 1.15.14-1.el7_9, go-toolset-1.15-scldevel 1.15.14-1.el7_9, go-toolset-1.15-golang-bin 1.15.14-1.el7_9, +4 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.15 1.15.14-1.el7_9, go-toolset-1.15-build 1.15.14-1.el7_9, go-toolset-1.15-golang 1.15.14-1.el7_9, go-toolset-1.15-runtime 1.15.14-1.el7_9, go-toolset-1.15-scldevel 1.15.14-1.el7_9, go-toolset-1.15-golang-bin 1.15.14-1.el7_9, +4 more
    fixed: vendor fix RHSA-2021:3015
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 7.5.9-4.el8, crit 3.18-4.module+el8.9.0+20326+387084d0, criu 3.18-4.module+el8.9.0+20326+387084d0, delve 1.5.0-2.module+el8.4.0+8864+58b0fcdb, crun 1.14.3-2.module+el8.10.0+21340+c6c7475a, runc 1.1.12-1.module+el8.10.0+21251+62b7388c, +36 more
    fixed: vendor fix RHSA-2024:2988
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.2.0-3.el9, podman-tests 4.2.0-3.el9, podman-docker 4.2.0-3.el9, podman-remote 4.2.0-3.el9, podman-gvproxy 4.2.0-3.el9, podman-plugins 4.2.0-3.el9
    fixed: vendor fix RHSA-2022:7954
  • Red Hat Migration Toolkit 1.5 rhmtc/openshift-velero-plugin-rhel8 v1.5.1-4, rhmtc/openshift-migration-velero-rhel8 v1.5.1-4, rhmtc/openshift-migration-registry-rhel8 v1.5.1-4, rhmtc/openshift-migration-must-gather-rhel8 v1.5.1-3, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 v1.5.1-4
    fixed: vendor fix RHSA-2021:3361
  • Red Hat OpenShift Container Platform 4.6 ignition 2.6.0-8.rhaos4.6.git947598e.el8, ignition-validate 2.6.0-8.rhaos4.6.git947598e.el8
    fixed: vendor fix RHSA-2021:3009
  • Red Hat OpenShift Container Platform 4.7 redhat-release-coreos 47.84-1.el8, cri-o 1.20.4-7.rhaos4.7.git6287500.el7, cri-o 1.20.4-7.rhaos4.7.git6287500.el8, ignition 2.9.0-4.rhaos4.7.git1d56dc8.el8, ignition-validate 2.9.0-4.rhaos4.7.git1d56dc8.el8, openshift 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7, +8 more
    fixed: vendor fix RHBA-2021:2979
  • Red Hat OpenShift Container Platform 4.8 cri-tools 1.21.0-3.el8, butane 0.12.1-2.rhaos4.8.el8, ignition 2.9.0-7.rhaos4.8.el8, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-validate 2.9.0-7.rhaos4.8.el8, +138 more
    fixed: vendor fix RHSA-2021:3248
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-etcd v4.9.0-202109302317.p0.git.5c1feaf.assembly.stream
    fixed: vendor fix RHSA-2021:3759
  • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-rhel8-operator 5.0.0-5, openshift4-wincw/windows-machine-config-operator-bundle v5.0.0-5
    fixed: vendor fix RHSA-2022:0577
  • Red Hat OpenShift Data Foundation 4.9 on RHEL-8 mcg 5.9.0-28.61dcf87.5.9.el8, odf4/ocs-operator-bundle 4.9.0-5, odf4/odf-operator-bundle 4.9.0-5, odf4/odr-hub-operator-bundle 4.9.0-5, odf4/odr-cluster-operator-bundle 4.9.0-5, odf4/odf-multicluster-operator-bundle 4.9.0-5, +10 more
    fixed: vendor fix RHSA-2021:5085
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.5-6, distributed-tracing/jaeger-query-rhel8 1.20.5-3, distributed-tracing/jaeger-ingester-rhel8 1.20.5-6, distributed-tracing/jaeger-rhel8-operator 1.20.5-5, distributed-tracing/jaeger-collector-rhel8 1.20.5-5, distributed-tracing/jaeger-all-in-one-rhel8 1.20.5-3
    fixed: vendor fix RHSA-2021:3229
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.23.2-1.el8
    fixed: vendor fix RHSA-2021:3555
  • Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8 0.23.2-2, openshift-serverless-1/serving-queue-rhel8 0.23.1-2, openshift-serverless-1/eventing-mtping-rhel8 0.23.0-5, openshift-serverless-1/kourier-control-rhel8 0.23.0-4, openshift-serverless-1/serving-webhook-rhel8 0.23.1-2, openshift-serverless-1/eventing-webhook-rhel8 0.23.0-5, +24 more
    fixed: vendor fix RHSA-2021:3556

6 more fixed, 15 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.98% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.15.14
>=1.16.0, <1.16.6
1.15.14
1.16.6
go stdlib
<1.15.14
>=1.16.0-0, <1.16.6
1.15.14
1.16.6

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.