CVE-2021-34558 Denial of service in n/a
A malicious TLS server can cause a Go TLS client to panic due to improper public key type assertion, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-34558?
CVE-2021-34558 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 15 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
Weakness: CWE-295
Which versions are affected by CVE-2021-34558?
2 open source packages ship an affected version, including golang and stdlib. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.15.14, 1.16.6 |
stdlib Go | All versions | 1.15.14, 1.16.6 |
Linux distribution packages (21)
go-toolset-1.15 Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-build Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-golang Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-golang-bin Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-golang-docs Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-golang-misc Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-golang-race Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-golang-src Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-golang-tests Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-runtime Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
go-toolset-1.15-scldevel Red Hat:devtools:2021 | All versions | 0:1.15.14-1.el7_9 |
rosa Red Hat:openshift_service_on_aws:1::el8 | All versions | 0:1.1.1-51c4a5e.el8 |
rosa-redistributable Red Hat:openshift_service_on_aws:1::el8 | All versions | 0:1.1.1-51c4a5e.el8 |
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.15.14-1.36.1 |
go1.16 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.16.6-1.20.1 |
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.15.14-1.36.1 |
go1.16 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.16.6-1.20.1 |
go1.15 openSUSE:Leap 15.2 | All versions | 1.15.14-lp152.23.1 |
go1.16 openSUSE:Leap 15.2 | All versions | 1.16.6-lp152.5.1 |
go1.15 openSUSE:Leap 15.3 | All versions | 1.15.14-1.36.1 |
go1.16 openSUSE:Leap 15.3 | All versions | 1.16.6-1.20.1 |
Products include Fedoraproject Fedora, Golang Go, Netapp Cloud Insights Telegraf, Netapp Storagegrid, Netapp Trident, Oracle Timesten In-Memory Database.
How do I fix CVE-2021-34558?
Upgrade golang to a fixed version for your release line: 1.15.14 or 1.16.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-34558 being exploited?
There is no known exploitation of CVE-2021-34558 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-105164, AZL-105167, BIT-golang-2021-34558, DEBIAN-CVE-2021-34558, GHSA-hqrm-74p3-w275, GO-2021-0243 and 9 more.