The crypto/tls package of Go through 1.16.5 does not properly assert that the type of…
Priority LOW 39CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 26 fixed, 20 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
Why it matters now
EPSS 0.06975 94th percentileScored 2026-11-07
Fix Partial Red Hat: 35 advisoriesRed Hat: 26 fixed, 20 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.15.14; 1.16.0 to before 1.16.6 | Vulnerable | Go standard library |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:cloud_insights_telegraf:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* | before 21.1.1.1.0 | Vulnerable | Oracle |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.15.14; 1.16.0 to before 1.16.6 Vulnerable ·Go standard library
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:cloud_insights_telegraf:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 21.1.1.1.0 Vulnerable ·Oracle
Remediation
Red Hat 35 advisories
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2022:7954 Released 2022-11-15 · Red Hat rating Moderatepodman security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.2.0-3.el9, podman-docker-2:4.2.0-3.el9, podman-gvproxy-2:4.2.0-3.el9 +3
- RHSA-2022:1372 Released 2022-04-13 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.10.0 enhancement, security & bug fix update
- RHODF 4.10 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +21
Show 32 more Red Hat advisories
- RHSA-2022:1329 Released 2022-04-12 · Red Hat rating ModerateOpenShift Virtualization 4.8.5 RPMs security update
- CNV 4.8 for RHEL 7 kubevirt-4.8.5-278.el7, kubevirt-virtctl-4.8.5-278.el7, kubevirt-virtctl-redistributable-4.8.5-278.el7
- CNV 4.8 for RHEL 8 kubevirt-4.8.5-278.el8, kubevirt-virtctl-4.8.5-278.el8, kubevirt-virtctl-redistributable-4.8.5-278.el8
- RHSA-2022:0577 Released 2022-03-28 · Red Hat rating ModerateWindows Container Support for Red Hat OpenShift 5.0.0 [security update]
- Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2022:0988 Released 2022-03-24 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1 (golang-github-vbatts-tar-split) security update
- Red Hat OpenStack Platform 16.1 golang-github-vbatts-tar-split-0.11.1-6.el8ost
- RHSA-2022:0998 Released 2022-03-23 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2 (golang-github-vbatts-tar-split) security update
- Red Hat OpenStack Platform 16.2 golang-github-vbatts-tar-split-0.11.1-6.el8ost
- RHSA-2022:0947 Released 2022-03-16 · Red Hat rating ModerateOpenShift Virtualization 4.10.0 Images security and bug fix update
- CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
- RHSA-2022:0260 Released 2022-01-25 · Red Hat rating ImportantRed Hat OpenStack Platform 16.1 (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-7.el8ost
- RHSA-2022:0237 Released 2022-01-24 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-7.el8ost
- RHSA-2022:0191 Released 2022-01-19 · Red Hat rating ModerateOpenShift Virtualization 4.9.2 Images security and bug fix update
- CNV 4.9 for RHEL 8 container-native-virtualization/virt-cdi-importer
- RHSA-2021:5086 Released 2021-12-13 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update
- Red Hat OpenShift Data Foundation 4.9 on RHEL-8 odf/odf-multicluster-rhel8-operator, odf4/cephcsi-rhel8, odf4/ocs-must-gather-rhel8 +12
- RHSA-2021:5085 Released 2021-12-13 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update
- Red Hat OpenShift Data Foundation 4.9 on RHEL-8 mcg-5.9.0-28.61dcf87.5.9.el8
- RHSA-2021:4914 Released 2021-12-02 · Red Hat rating ModerateOpenShift Virtualization 4.8.3 Images security and bug fix update
- CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
- RHSA-2021:4725 Released 2021-11-17 · Red Hat rating ModerateOpenShift Virtualization 2.6.8 Images security and bug fix update
- CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
- RHSA-2021:4722 Released 2021-11-17 · Red Hat rating ModerateOpenShift Virtualization 2.6.8 RPMs security and bug fix update
- CNV 2.6 for RHEL 7 kubevirt-2.6.8-211.el7, kubevirt-virtctl-2.6.8-211.el7, kubevirt-virtctl-redistributable-2.6.8-211.el7
- CNV 2.6 for RHEL 8 kubevirt-2.6.8-211.el8, kubevirt-virtctl-2.6.8-211.el8, kubevirt-virtctl-redistributable-2.6.8-211.el8
- RHSA-2021:4582 Released 2021-11-10 · Red Hat rating ModerateRelease of components for Service Telemetry Framework 1.3.3 - Container Images
- Service Telemetry Framework 1.3 for RHEL 8 stf/service-telemetry-operator-bundle, stf/service-telemetry-rhel8-operator, stf/sg-core-rhel8 +2
- RHSA-2021:4226 Released 2021-11-09 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.9-4.el8
- RHSA-2021:4104 Released 2021-11-02 · Red Hat rating ModerateOpenShift Virtualization 4.9.0 Images security and bug fix update
- CNV 4.9 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +24
- RHSA-2021:3820 Released 2021-10-19 · Red Hat rating ModerateOpenShift Container Platform 4.8.15 packages and security update
- Red Hat OpenShift Container Platform 4.8 butane-0.12.1-2.rhaos4.8.el8, jenkins-2.289.3.1633554819-1.el8
- RHSA-2021:3759 Released 2021-10-18 · Red Hat rating ModerateOpenShift Container Platform 4.9.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.9 openshift4/ose-baremetal-rhel8-operator, openshift4/ose-console, openshift4/ose-etcd +4
- RHSA-2021:3733 Released 2021-10-06 · Red Hat rating LowOpenShift Virtualization 2.6.7 Images security and bug fix update
- CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
- RHSA-2021:3598 Released 2021-09-21 · Red Hat rating ModerateOpenShift Virtualization 4.8.2 Images security and bug fix update
- CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
- RHSA-2021:3556 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless 1.17.0
- Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
- RHSA-2021:3555 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.17.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.23.2-1.el8
- RHSA-2021:3248 Released 2021-08-31 · Red Hat rating ModerateOpenShift Container Platform 4.8.9 packages and security update
- Red Hat OpenShift Container Platform 4.8 containernetworking-plugins-0.8.6-3.rhaos4.6.el7, cri-tools-1.21.0-3.el8, golang-github-prometheus-promu-0.5.0-4.git642a960.el8 +1
- RHSA-2021:3361 Released 2021-08-31 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.5.1 security and bug fix update
- 8Base-RHMTC-1.5 rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 +2
- RHSA-2021:3259 Released 2021-08-24 · Red Hat rating ModerateOpenShift Virtualization 4.8.1 Images security and bug fix update
- CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
- RHSA-2021:3229 Released 2021-08-19 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.20.5 security update
- Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +3
- RHSA-2021:3146 Released 2021-08-12 · Red Hat rating ModerateACS 3.64 security and enhancement update
- RHACS 3.64 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator
- RHSA-2021:3009 Released 2021-08-12 · Red Hat rating ModerateOpenShift Container Platform 4.6.42 security update
- Red Hat OpenShift Container Platform 4.6 ignition-2.6.0-8.rhaos4.6.git947598e.el8, ignition-validate-2.6.0-8.rhaos4.6.git947598e.el8
- RHSA-2021:3076 Released 2021-08-10 · Red Hat rating Moderatego-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-1.module+el8.4.0+11833+614b07b8.aarch64::go-toolset:rhel8 +18
- RHSA-2021:2983 Released 2021-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.8.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
- RHSA-2021:2984 Released 2021-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.8.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 cri-o-1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o-1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-2.9.0-7.rhaos4.8.el8 +9
- RHSA-2021:3015 Released 2021-08-05 · Red Hat rating Moderatego-toolset-1.15 and go-toolset-1.15-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.15-1.15.14-1.el7_9, go-toolset-1.15-build-1.15.14-1.el7_9, go-toolset-1.15-golang-1.15.14-1.el7_9 +8
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.15-1.15.14-1.el7_9, go-toolset-1.15-build-1.15.14-1.el7_9, go-toolset-1.15-golang-1.15.14-1.el7_9 +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.2 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.5 | Fixed | RHSA-2021:3361 |
| CNV 2.6 for RHEL 7 | Fixed | RHSA-2021:4722 |
| CNV 2.6 for RHEL 8 | Fixed | RHSA-2021:3733, RHSA-2021:4722 |
| CNV 4.8 for RHEL 7 | Fixed | RHSA-2022:1329 |
| CNV 4.8 for RHEL 8 | Fixed | RHSA-2021:3598, RHSA-2022:1329 |
| CNV 4.9 for RHEL 8 | Fixed | RHSA-2021:4104, RHSA-2022:0191 |
| OpenShift Sandboxed Containers 1.1.0 | Fixed | — |
| RHACS 3.64 for RHEL 8 | Fixed | RHSA-2021:3146 |
| RHODF 4.10 for RHEL 8 | Fixed | RHSA-2022:1372 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3015 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3015 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:3076, RHSA-2021:4226, RHSA-2024:2988 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:7954 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:0577 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2021:3009 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | — |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2983, RHSA-2021:2984, RHSA-2021:3248, RHSA-2021:3820 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2021:3759 |
| Red Hat OpenShift Data Foundation 4.9 on RHEL-8 | Fixed | RHSA-2021:5085, RHSA-2021:5086 |
| Red Hat OpenShift Jaeger 1.20 | Fixed | RHSA-2021:3229 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2021:3555 |
| Red Hat OpenShift Serverless 1.17 | Fixed | RHSA-2021:3556 |
| Red Hat OpenShift Service on AWS 1.0 | Fixed | — |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2022:0260, RHSA-2022:0988 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2022:0237, RHSA-2022:0998 |
| Service Telemetry Framework 1.3 for RHEL 8 | Fixed | RHSA-2021:4582 |
Not affected: 16 products
- 7Server-RHMTC-1.5
- 8Base-RHMTC-1.5
- CNV 4.9 for RHEL 8
- OpenShift Sandboxed Containers 1.1.0
- RHACS 3.64 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenShift Container Platform 4.7
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift Jaeger 1.20
- Red Hat Quay 3
- Service Telemetry Framework 1.3 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-34558
- 2026-10-03 Alias added: GHSA-hqrm-74p3-w275
References
Patch 2
Advisory 14
- https://groups.google.com/g/golang-announce
- https://golang.org/doc/devel/release#go1.16.minor
- FEDORA-2021-25c0011e78
- FEDORA-2021-1bfb61f77c
- FEDORA-2021-3a55403080
- FEDORA-2021-47d259d3cf
- FEDORA-2021-6ac9b98f9e
- FEDORA-2021-07e4d20196
- FEDORA-2021-ffa749f7f7
- FEDORA-2021-54f88bebd4
- FEDORA-2021-c35235c250
- https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ
- https://security.netapp.com/advisory/ntap-20210813-0005/
- GLSA-202208-02
Sources
- CVE-2021-34558 · CVE Program
- CVE-2021-34558 · NVD
- FIRST EPSS
- GHSA-hqrm-74p3-w275 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-34558 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences