CVEvulnerability

CVE-2021-34558

6.5 MEDIUM Published 2021-07-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-07-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:N/I:N/A:P
Weaknesses
CWE-295

Description

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Affected configurations

• golang go (< 1.15.14) • golang go (>= 1.16.0 < 1.16.6) • fedoraproject fedora 33 • fedoraproject fedora 34 • netapp cloud insights telegraf • netapp storagegrid • netapp trident • oracle timesten in-memory database (< 21.1.1.1.0)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References