VDB

CVE-2021-34558

CVE-2021-34558 PUBLISHED

Reported by mitre · Published July 15, 2021

stdlib is fixed in 1.16.6 and 1.15.14 (Go Modules)

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
stdlibGo Modules1.16.6, 1.15.14
golangAmazon Linux1.15.14-1.amzn2.0.1
goAlpine1.16.6-r0, 1.15.14-r0
golangBitnami1.16.6, 1.15.14
golang-binAmazon Linux1.15.14-1.amzn2.0.1
golangBitnami1.16.6, 1.15.14
timesten_in-memory_databaseoracle21.1.1.1.0
gogolang1.16.6, 1.15.14

Affected products

VendorProductVersions
n/an/an/a
amazon:2golang0
alpinego0, 0
amazon:2golang-bin0
n/an/a*
amazon:2golang-misc0
amazon:2golang-tests0
amazon:2golang-race0
amazon:2golang-docs0
amazon:2golang-src0
archgo0

Timeline

  • Jul 15, 2021 CVE Published
  • Jul 16, 2021 EPSS Score (30 in total, the first dated here)
  • Feb 8, 2024 PoC Published
  • Aug 4, 2024 CVE Updated
  • Mar 10, 2026 Security Advisory (43 in total, the first dated here)
  • Jul 29, 2026 Coalition ESS Score
  • Nov 4, 2026 Distribution Patch (36 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-34558
vulnetix vdb fixes CVE-2021-34558

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-34558/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›