Read the docs
TI-2021-02215 Aliases CVE-2021-3121GHSA-c3h9-896r-86jm

An issue was discovered in GoGo Protobuf before 1.3.2.

Priority MEDIUM 43CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 13 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Why it matters now

EPSS 0.03425 88th percentileScored 2026-11-07
Fix Partial github.com/gogo/protobuf (Go): 1.3.2Red Hat: 32 advisoriesRed Hat: 13 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/gogo/protobuf (Go)before 1.3.21.3.2Patch availableGHSA-c3h9-896r-86jm
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/gogo/protobuf (Go) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-c3h9-896r-86jm

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:golang:protobuf:*:*:*:*:*:*:*:*before 1.3.2VulnerableGo standard library
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*before 1.8.15VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*before 1.8.15VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*1.9.0 to before 1.9.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.9.0 to before 1.9.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*1.10.0 to before 1.10.2VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.10.0 to before 1.10.2VulnerableHashiCorp
  • cpe:2.3:a:golang:protobuf:*:*:*:*:*:*:*:* Versions before 1.3.2 Vulnerable ·Go standard library
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions before 1.8.15 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions before 1.8.15 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions 1.9.0 to before 1.9.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.9.0 to before 1.9.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions 1.10.0 to before 1.10.2 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.10.0 to before 1.10.2 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-c3h9-896r-86jm github.com/gogo/protobuf (Go) Fixed in 1.3.2 Advisory →

Red Hat 32 advisories

  • RHSA-2022:6916 Released 2022-10-12 · Red Hat rating Important
    Red Hat AMQ Broker 7.10.1 release and security update
    • AMQ Broker 7.10.1
  • RHSA-2022:6536 Released 2022-09-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.11.5 bug fix and security update
    • Red Hat OpenShift Container Platform 4.11 openshift4/ose-telemeter
  • RHSA-2022:1679 Released 2022-05-10 · Red Hat rating Moderate
    Cryostat 2.1.0: new Cryostat on RHEL 8 container images
    • Cryostat 2 on RHEL 8 cryostat-20-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-20-tech-preview/cryostat-operator-bundle, cryostat-20-tech-preview/cryostat-rhel8 +8
Show 29 more Red Hat advisories
  • RHSA-2022:1276 Released 2022-04-07 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.0.9 security update
    • OpenShift Service Mesh 2.0 kiali-v1.24.7.redhat1-1.el8, servicemesh-2.0.9-3.el8, servicemesh-istioctl-2.0.9-3.el8 +6
  • RHSA-2022:0577 Released 2022-03-28 · Red Hat rating Moderate
    Windows Container Support for Red Hat OpenShift 5.0.0 [security update]
    • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
  • RHSA-2022:0056 Released 2022-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.3 security update
    • Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2022:0283 Released 2022-02-03 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.42 security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cluster-network-operator
  • RHSA-2021:4104 Released 2021-11-02 · Red Hat rating Moderate
    OpenShift Virtualization 4.9.0 Images security and bug fix update
    • CNV 4.9 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +24
  • RHSA-2021:3759 Released 2021-10-18 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.9 openshift4/ose-baremetal-rhel8-operator, openshift4/ose-console, openshift4/ose-etcd +4
  • RHSA-2021:3303 Released 2021-09-08 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
  • RHSA-2021:3262 Released 2021-09-01 · Red Hat rating Important
    OpenShift Container Platform 4.7.28 security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cluster-autoscaler
  • RHSA-2021:3259 Released 2021-08-24 · Red Hat rating Moderate
    OpenShift Virtualization 4.8.1 Images security and bug fix update
    • CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
  • RHSA-2021:2977 Released 2021-08-11 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.23 security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cluster-openshift-controller-manager-operator, openshift4/ose-cluster-version-operator, openshift4/ose-openshift-controller-manager-rhel8
  • RHSA-2021:2920 Released 2021-07-28 · Red Hat rating Moderate
    OpenShift Virtualization 4.8.0 Images
    • CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
  • RHSA-2021:2437 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 packages and security update
    • Red Hat OpenShift Container Platform 4.8 afterburn-5.0.0-1.rhaos4.8.el8, atomic-openshift-service-idler-4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8, butane-0.12.1-1.rhaos4.8.el8 +47
  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2021:2286 Released 2021-06-15 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.16 security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-azure-machine-controllers
  • RHSA-2021:2374 Released 2021-06-14 · Red Hat rating Moderate
    Openshift Logging Bug Fix Release (5.0.5)
    • OpenShift Logging 5.0 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/eventrouter-rhel8
  • RHSA-2021:2121 Released 2021-06-01 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.13 bug fix and security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-aws-machine-controllers, openshift4/ose-cluster-autoscaler-operator, openshift4/ose-cluster-machine-approver +2
  • RHSA-2021:2136 Released 2021-05-26 · Red Hat rating Moderate
    Openshift Logging security and bugs update (5.0.4)
    • OpenShift Logging 5.0 openshift-logging/cluster-logging-rhel8-operator
  • RHSA-2021:1563 Released 2021-05-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.12 extras and security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/network-tools-rhel8, openshift4/ose-cluster-kube-descheduler-operator, openshift4/ose-cluster-kube-descheduler-rhel8-operator +1
  • RHSA-2021:1552 Released 2021-05-19 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.11 security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-sriov-dp-admission-controller, openshift4/ose-sriov-infiniband-cni
  • RHSA-2021:1225 Released 2021-04-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.8 security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-ovn-kubernetes, openshift4/ose-sdn-rhel8
  • RHSA-2021:1227 Released 2021-04-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.8 security and extras update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-sriov-network-config-daemon
  • RHSA-2021:1005 Released 2021-04-05 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.5 security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cluster-kube-controller-manager-operator, openshift4/ose-cluster-kube-scheduler-operator, openshift4/ose-cluster-policy-controller-rhel8 +1
  • RHSA-2021:1007 Released 2021-04-05 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.5 security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cluster-kube-descheduler-operator, openshift4/ose-cluster-kube-descheduler-rhel8-operator, openshift4/ose-metering-ansible-operator +2
  • RHSA-2021:1006 Released 2021-04-05 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.5 security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 cri-o-1.20.2-4.rhaos4.7.gitd5a999a.el7, cri-o-1.20.2-4.rhaos4.7.gitd5a999a.el8, jenkins-2-plugins-4.7.1616671397-1.el8 +4
  • RHSA-2021:0799 Released 2021-03-10 · Red Hat rating Moderate
    OpenShift Virtualization 2.6.0 security and bug fix update
    • CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
  • RHSA-2021:0719 Released 2021-03-04 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.0.8 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8 rhacm2/acm-operator-bundle
  • RHSA-2020:5635 Released 2021-02-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.0 extras and security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cluster-capacity, openshift4/ose-cluster-nfd-operator, openshift4/ose-metering-helm-container-rhel8 +2
  • RHSA-2020:5634 Released 2021-02-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.0 packages security update
    • Red Hat OpenShift Container Platform 4.7 cri-o-1.20.0-0.rhaos4.7.git8921e00.el7.51, cri-o-1.20.0-0.rhaos4.7.git8921e00.el8.51, cri-tools-1.18.0-3.el7 +9
  • RHSA-2021:0607 Released 2021-02-18 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.1.3 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8 rhacm2/acm-must-gather-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
AMQ Broker 7.10.1Fixed RHSA-2022:6916
CNV 4.8 for RHEL 8Fixed RHSA-2021:2920, RHSA-2021:3259
CNV 4.9 for RHEL 8Fixed RHSA-2021:4104
Cryostat 2 on RHEL 8Fixed RHSA-2022:1679
OpenShift Logging 5.0Fixed RHSA-2021:2136, RHSA-2021:2374
OpenShift Service Mesh 2.0Fixed RHSA-2022:1276
Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8Fixed RHSA-2021:0719
Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8Fixed RHSA-2021:0607
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:0056, RHSA-2022:0577
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2022:6536
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2020:5633, RHSA-2020:5634, RHSA-2020:5635, RHSA-2021:1005, RHSA-2021:1006, RHSA-2021:1007, RHSA-2021:1225, RHSA-2021:1227, RHSA-2021:1552, RHSA-2021:1563, RHSA-2021:2121, RHSA-2021:2286, RHSA-2021:2977, RHSA-2021:3262, RHSA-2021:3303, RHSA-2022:0283
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2437, RHSA-2021:2438
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2021:3759
Not affected: 11 products
  • CNV 4.9 for RHEL 8
  • Distributed Tracing Jaeger 1
  • OpenShift Logging 5.0
  • OpenShift Service Mesh 2.0
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Container Platform 4.9
  • Red Hat Openshift Container Storage 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3121
  2. 2026-10-03 Alias added: GHSA-c3h9-896r-86jm

References

Patch 2

Advisory 3

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences