CVE-2021-34558

MEDIUM

6.5

CVSS Score

Published: July 15, 2021 at 01:47 PM UTC

Updated: June 17, 2026 at 03:56 AM UTC

6 products affected across 4 vendorsFedoraGoStorageGRID

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 7%

Description

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedora · Fedora Projectrpm

95%

33 34

Go · Golang

95%

v < 1.15.141.16.0 ≤ v < 1.16.6

Affected range stops below 1.15.14, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.16.6, so it looks safe — our inference, not a vendor statement

Cloud Insights Telegraf · NetApp

95%

All versions

StorageGRID · NetApp

95%

All versions

Trident · NetApp

95%

All versions

Timesten in Memory Database · Oracle

95%

v < 21.1.1.1.0

Affected range stops below 21.1.1.1.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (16)

x_refsource_MISCRelease NotesVendor Advisory

Source: [email protected]

https://golang.org/doc/devel/release#go1.16.minor

x_refsource_MISCMailing ListThird Party Advisory

Source: [email protected]

https://groups.google.com/g/golang-announce

x_refsource_MISCMailing ListRelease NotesThird Party Advisory

Source: [email protected]

https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ