In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate…
Priority LOW 34CWE-682Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 17 fixed, 15 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
Why it matters now
EPSS 0.02699 86th percentileScored 2026-11-07
Fix Partial Red Hat: 23 advisoriesRed Hat: 17 fixed, 15 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.14.14; 1.15 to before 1.15.7 | Vulnerable | Go standard library |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.14.14; 1.15 to before 1.15.7 Vulnerable ·Go standard library
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 23 advisories
- RHSA-2022:0308 Released 2022-01-27 · Red Hat rating ModerateOpenShift Container Storage 3.11.z security and bug fix update
- Red Hat Gluster Storage Server 3.5 on RHEL-7 heketi-10.4.0-2.el7rhgs, heketi-client-10.4.0-2.el7rhgs, python-heketi-10.4.0-2.el7rhgs
- Red Hat Storage Native Client for Red Hat Enterprise Linux 7 heketi-10.4.0-2.el7rhgs, heketi-client-10.4.0-2.el7rhgs
- RHSA-2021:4226 Released 2021-11-09 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.9-4.el8
- RHSA-2021:4103 Released 2021-11-02 · Red Hat rating ModerateOpenShift Virtualization 4.9.0 RPMs security and bug fix update
- CNV 4.9 for RHEL 7 kubevirt-4.9.0-287.el7, kubevirt-virtctl-4.9.0-287.el7, kubevirt-virtctl-redistributable-4.9.0-287.el7
- CNV 4.9 for RHEL 8 kubevirt-4.9.0-287.el8, kubevirt-virtctl-4.9.0-287.el8, kubevirt-virtctl-redistributable-4.9.0-287.el8
Show 20 more Red Hat advisories
- RHSA-2021:3748 Released 2021-10-07 · Red Hat rating ModerateOpenShift Container Storage 3.11.z Container Images Security and Bug Fix Update
- Red Hat Gluster Storage Server 3.5 on RHEL-7 rhgs3/rhgs-gluster-block-prov-rhel7
- RHSA-2021:3119 Released 2021-08-10 · Red Hat rating ModerateOpenShift Virtualization 2.6.6 Images security and bug fix update
- CNV 2.6 for RHEL 8 container-native-virtualization/vm-import-controller, container-native-virtualization/vm-import-controller-rhel8
- RHSA-2021:2920 Released 2021-07-28 · Red Hat rating ModerateOpenShift Virtualization 4.8.0 Images
- CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
- RHSA-2021:2437 Released 2021-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.8.2 packages and security update
- Red Hat OpenShift Container Platform 4.8 afterburn-5.0.0-1.rhaos4.8.el8, atomic-openshift-service-idler-4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8, butane-0.12.1-1.rhaos4.8.el8 +47
- RHSA-2021:2438 Released 2021-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.8.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2021:2543 Released 2021-06-24 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.20.4 security update
- Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +5
- RHSA-2021:2532 Released 2021-06-23 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.17.9 security update
- Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +3
- RHSA-2021:1562 Released 2021-05-24 · Red Hat rating ImportantOpenShift Container Platform 4.7.12 packages and security update
- Red Hat OpenShift Container Platform 4.7 jenkins-2.277.3.1620985335-1.el8, openshift-4.7.0-202105160013.p0.git.df9c838.el7, openshift-4.7.0-202105160013.p0.git.df9c838.el8 +9
- RHSA-2021:2095 Released 2021-05-24 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.14.1 security update
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.20.0-7.el8
- RHSA-2021:2093 Released 2021-05-24 · Red Hat rating ModerateRelease of OpenShift Serverless 1.14.1 security update
- Openshift Serverless 1.14 openshift-serverless-1/kn-cli-artifacts-rhel8, openshift-serverless-1/knative-rhel8-operator, openshift-serverless-1/serverless-operator-bundle
- RHSA-2021:1551 Released 2021-05-19 · Red Hat rating ModerateOpenShift Container Platform 4.7.11 security and bug fix update
- Red Hat OpenShift Container Platform 4.7 cri-tools-1.20.0-2.el7, cri-tools-1.20.0-2.el8, jenkins-2.277.3.1620393611-1.el8 +2
- RHSA-2021:2041 Released 2021-05-19 · Red Hat rating ModerateRed Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update
- Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator
- RHSA-2021:2021 Released 2021-05-19 · Red Hat rating ModerateRelease of OpenShift Serverless 1.10.2 security update
- Red Hat OpenShift Serverless 1.10 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/ingress-rhel8-operator, openshift-serverless-1/kn-cli-artifacts-rhel8 +12
- RHSA-2021:1746 Released 2021-05-18 · Red Hat rating Moderatego-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.aarch64::go-toolset:rhel8 +18
- RHSA-2021:1366 Released 2021-05-04 · Red Hat rating ModerateOpenShift Container Platform 4.7.9 packages and security update
- Red Hat OpenShift Container Platform 4.7 golang-github-prometheus-promu-0.5.0-3.git642a960.el8, prometheus-promu-0.5.0-3.git642a960.el8
- RHSA-2021:1338 Released 2021-04-22 · Red Hat rating ModerateRelease of OpenShift Serverless 1.14.0 security update
- Openshift Serverless 1.14 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +25
- RHSA-2021:1339 Released 2021-04-22 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.14.0 and security update
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.20.0-6.el8
- RHSA-2021:1006 Released 2021-04-05 · Red Hat rating ModerateOpenShift Container Platform 4.7.5 security and bug fix update
- Red Hat OpenShift Container Platform 4.7 cri-o-1.20.2-4.rhaos4.7.gitd5a999a.el7, cri-o-1.20.2-4.rhaos4.7.gitd5a999a.el8, jenkins-2-plugins-4.7.1616671397-1.el8 +4
- RHSA-2021:0957 Released 2021-03-30 · Red Hat rating ModerateOpenShift Container Platform 4.7.4 security update
- Red Hat OpenShift Container Platform 4.7 openshift4/egress-router-cni-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8-operator +47
- RHSA-2021:0958 Released 2021-03-30 · Red Hat rating ModerateOpenShift Container Platform 4.7.4 security update
- Red Hat OpenShift Container Platform 4.7 openshift-4.7.0-202103181538.p0.git.97109.7576cdc.el7, openshift-4.7.0-202103181538.p0.git.97109.7576cdc.el8, openshift-clients-4.7.0-202103191426.p0.git.3953.f3a7513.el7 +5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| CNV 2.6 for RHEL 8 | Fixed | RHSA-2021:3119 |
| CNV 4.8 for RHEL 8 | Fixed | RHSA-2021:2920 |
| CNV 4.9 for RHEL 7 | Fixed | RHSA-2021:4103 |
| CNV 4.9 for RHEL 8 | Fixed | RHSA-2021:4103 |
| OpenShift Logging 5.0 | Fixed | — |
| Openshift Serverless 1.14 | Fixed | RHSA-2021:1338, RHSA-2021:2093 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:1746, RHSA-2021:4226 |
| Red Hat Gluster Storage Server 3.5 on RHEL-7 | Fixed | RHSA-2021:3748, RHSA-2022:0308 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | — |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2021:0957, RHSA-2021:0958, RHSA-2021:1006, RHSA-2021:1366, RHSA-2021:1551, RHSA-2021:1562 |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2437, RHSA-2021:2438 |
| Red Hat OpenShift Container Storage 4.7 on RHEL-8 | Fixed | RHSA-2021:2041 |
| Red Hat OpenShift Jaeger 1.17 | Fixed | RHSA-2021:2532 |
| Red Hat OpenShift Jaeger 1.20 | Fixed | RHSA-2021:2543 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2021:1339, RHSA-2021:2095 |
| Red Hat OpenShift Serverless 1.10 | Fixed | RHSA-2021:2021 |
| Red Hat Storage Native Client for Red Hat Enterprise Linux 7 | Fixed | RHSA-2022:0308 |
Not affected: 14 products
- CNV 2.6 for RHEL 8
- OpenShift Logging 5.0
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Gluster Storage Server 3.5 on RHEL-7
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenShift Container Platform 4.7
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Container Storage 4.7 on RHEL-8
- Red Hat OpenShift Jaeger 1.17
- Red Hat OpenShift Jaeger 1.20
- Red Hat Openshift Container Storage 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3114
- 2026-10-03 Alias added: GHSA-gwfm-9vvh-63r3
References
Advisory 7
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- FEDORA-2021-e435a8bb88
- DSA-4848
- https://security.netapp.com/advisory/ntap-20210219-0001/
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update
- GLSA-202208-02
Sources
- CVE-2021-3114 · CVE Program
- CVE-2021-3114 · NVD
- FIRST EPSS
- GHSA-gwfm-9vvh-63r3 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3114 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences