VDB
RHSA-2021%3A2532
RHSA-2021%3A2532
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the math/big package of Go's standard library that causes a denial of service. Applications written in Go that use math/big via cryptographic packages, including crypto/rsa and crypto/x509, are vulnerable and can potentially cause panic via a crafted certificate chain. The highest threat from this vulnerability is to system availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | distributed-tracing/jaeger-query-rhel8@sha256:0cc5eae19cab7732b61418212ce3564e948769240f9d2a4bcaa127afd986f968_s390x as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-query-rhel8@sha256:0cc5eae19cab7732b61418212ce3564e948769240f9d2a4bcaa127afd986f968_s390x |
| Red Hat | distributed-tracing/jaeger-ingester-rhel8@sha256:cf51d733170ac61077cea0b2a7970d92cc077d4ea731c7a9493af9665fd3cd5f_ppc64le as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-ingester-rhel8@sha256:cf51d733170ac61077cea0b2a7970d92cc077d4ea731c7a9493af9665fd3cd5f_ppc64le |
| Red Hat | distributed-tracing/jaeger-agent-rhel8@sha256:83c39c6a9af8bc7a78c1f5015d8f3f98e4901f5e013e0e6c39611f96c10c005a_ppc64le as a component of Red Hat OpenShift Jaeger 1.17 | * |
| Red Hat | distributed-tracing/jaeger-rhel8-operator@sha256:5c284ed14cc4cb17f075c28790fb295046cb212e35647390d0bfa00a63522146_ppc64le as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-rhel8-operator@sha256:5c284ed14cc4cb17f075c28790fb295046cb212e35647390d0bfa00a63522146_ppc64le |
| Red Hat | distributed-tracing/jaeger-collector-rhel8@sha256:c17fb6a021f391948c0725f0a839684538f57805393f2123732db08fe5c32009_s390x as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-collector-rhel8@sha256:c17fb6a021f391948c0725f0a839684538f57805393f2123732db08fe5c32009_s390x |
| Red Hat | distributed-tracing/jaeger-ingester-rhel8@sha256:582ff08b5c186cdc27b1d5a340c66a841b3ff10f5ee669f9135e5b9f0303d551_s390x as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-ingester-rhel8@sha256:582ff08b5c186cdc27b1d5a340c66a841b3ff10f5ee669f9135e5b9f0303d551_s390x |
| Red Hat | distributed-tracing/jaeger-es-rollover-rhel8@sha256:9c4bc759b3194d5d93448efff4a7b1e60d077e49f1a2a7452da263e46813a35a_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-es-rollover-rhel8@sha256:9c4bc759b3194d5d93448efff4a7b1e60d077e49f1a2a7452da263e46813a35a_amd64 |
| Red Hat | distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:bbc2a4caa4458377ed2de14841178707da55589383e090b54c2b13c6a110bc81_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | * |
| Red Hat | distributed-tracing/jaeger-all-in-one-rhel8@sha256:b585c3a9b824de0f51789a8fecf4a2f7bf9e168b6a3573250bf69d9f782b9bed_s390x as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-all-in-one-rhel8@sha256:b585c3a9b824de0f51789a8fecf4a2f7bf9e168b6a3573250bf69d9f782b9bed_s390x |
| Red Hat | distributed-tracing/jaeger-collector-rhel8@sha256:324d5c7182e1edce237c884164ca5a5ad8766591ff1c6cc6613aa6b7ebb2646b_ppc64le as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-collector-rhel8@sha256:324d5c7182e1edce237c884164ca5a5ad8766591ff1c6cc6613aa6b7ebb2646b_ppc64le |
| Red Hat | distributed-tracing/jaeger-collector-rhel8@sha256:db34eb04544e03eb56bf606c95d19f79bbd7ec56bd8c500b49fa448718202c9c_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-collector-rhel8@sha256:db34eb04544e03eb56bf606c95d19f79bbd7ec56bd8c500b49fa448718202c9c_amd64 |
| Red Hat | distributed-tracing/jaeger-all-in-one-rhel8@sha256:acb62df32ace2fd13bd5ce9874760d95d567d91bb110b26b19c596fb7d86fef1_ppc64le as a component of Red Hat OpenShift Jaeger 1.17 | * |
| Red Hat | distributed-tracing/jaeger-rhel8-operator@sha256:7df80c3aa4d769c1e57c4b33503a5fb806d0f79fc31f6351e17da5d97306c243_s390x as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-rhel8-operator@sha256:7df80c3aa4d769c1e57c4b33503a5fb806d0f79fc31f6351e17da5d97306c243_s390x |
| Red Hat | distributed-tracing/jaeger-query-rhel8@sha256:1c5f7c95cda7e7220c158cb254ba24ad9a358caf364533cfeb6cfd02504a64bf_ppc64le as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-query-rhel8@sha256:1c5f7c95cda7e7220c158cb254ba24ad9a358caf364533cfeb6cfd02504a64bf_ppc64le |
| Red Hat | distributed-tracing/jaeger-query-rhel8@sha256:4c5ac9c1f7833ad630f2d5154100234e762c9e5d6f0118b17bb2efceb1d8a625_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | * |
| Red Hat | distributed-tracing/jaeger-ingester-rhel8@sha256:81a58e46655d527624cbbba483639e76c21e819e4bf5c65a565d45af79c1832c_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-ingester-rhel8@sha256:81a58e46655d527624cbbba483639e76c21e819e4bf5c65a565d45af79c1832c_amd64 |
| Red Hat | distributed-tracing/jaeger-es-rollover-rhel8@sha256:873fb90564825ff2d3f5881d6db14efb40f9195bee5908e35cf1352c8acc87a9_s390x as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-es-rollover-rhel8@sha256:873fb90564825ff2d3f5881d6db14efb40f9195bee5908e35cf1352c8acc87a9_s390x |
| Red Hat | distributed-tracing/jaeger-es-rollover-rhel8@sha256:68a13a7b385494c25e6af73f6b6b555c026f3f06566b935f97f8efd9a76c6449_ppc64le as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-es-rollover-rhel8@sha256:68a13a7b385494c25e6af73f6b6b555c026f3f06566b935f97f8efd9a76c6449_ppc64le |
| Red Hat | distributed-tracing/jaeger-agent-rhel8@sha256:5230c70692537b4da57bb1ac5bc80810bdef4081f2e739172ed71f8368856afb_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-agent-rhel8@sha256:5230c70692537b4da57bb1ac5bc80810bdef4081f2e739172ed71f8368856afb_amd64 |
| Red Hat | distributed-tracing/jaeger-rhel8-operator@sha256:57c5dd6f4bb187b4c96b482f6fda7f15d2110126c8f15430b46c2b4489a78384_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | * |
…and 4 more
Timeline
- Jun 23, 2021 CVE Published
- Apr 30, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2021:2532 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1897635 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1918750 issue
- https://issues.redhat.com/browse/TRACING-1725 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2532.json advisory
- https://access.redhat.com/security/cve/CVE-2020-28362 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-28362 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-28362 advisory
- https://access.redhat.com/security/cve/CVE-2021-3114 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-3114 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-3114 advisory
- https://groups.google.com/g/golang-announce/c/mperVMGa98w advisory