CVE-2021-34558: Input Validation

Q: What is the vulnerability ID of this flaw?

The vulnerability ID of this flaw is CVE-2021-34558.

Q: What is the severity of CVE-2021-34558?

The severity of CVE-2021-34558 is medium with a CVSS score of 6.5.

Q: Which software is affected by CVE-2021-34558?

The affected software includes openshift-serverless-clients, go-toolset, grafana, podman, ignition, atomic-openshift-service-idler, cri-o, openshift, openshift-clients, redhat-release-coreos, containernetworking-plugins, cri-tools, golang-github-prometheus-promu, butane, mcg, etcd, golang-github-vbatts-tar-split, kubevirt, rosa, Golang Go, Fedoraproject Fedora, Netapp Cloud Insights Telegraf, Netapp Storagegrid, Netapp Trident, and Oracle TimesTen In-Memory Database.

Q: How can an attacker trigger a panic in the affected software?

An attacker can trigger a panic in the affected software by being in a privileged network position without access to the server certificate's private key.

Q: How can I mitigate the vulnerability?

To mitigate the vulnerability, you should update the affected software to the recommended version provided by the software vendor.

Published Jul 13, 2021

Updated

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with Config.InsecureSkipVerify. Clients that disable all TLSRSA cipher suites (that is, TLS 1.0–1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.

Other sources

crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with Config.InsecureSkipVerify. Clients that disable all TLSRSA cipher suites (that is, TLS 1.0–1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.

References: https://golang.org/doc/devel/release https://github.com/golang/go/issues/47145 https://github.com/golang/go/issues/47144

— Red Hat

Golang Go is vulnerable to a denial of service, caused by the failure to properly assert that the type of public key in an X.509 certificate matches the expected type in the crypto/tls package. By persuading a victim to connect to a specially-crafted TLS server, a remote attacker could exploit this vulnerability to cause a TLS client to panic.

— IBM

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange allowing a malicious TLS server to cause a TLS client to panic.

— Microsoft

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Affected Software

41 affected componentsFixes available

redhat/openshift-serverless-clients<0:0.23.2-1.el8

0:0.23.2-1.el8

redhat/go-toolset<1.15-0:1.15.14-1.el7_9

1.15-0:1.15.14-1.el7_9

redhat/go-toolset<1.15-golang-0:1.15.14-1.el7_9

1.15-golang-0:1.15.14-1.el7_9

redhat/grafana<0:7.5.9-4.el8

0:7.5.9-4.el8

redhat/podman<2:4.2.0-3.el9

2:4.2.0-3.el9

redhat/ignition<0:2.6.0-8.rhaos4.6.git947598e.el8

0:2.6.0-8.rhaos4.6.git947598e.el8

redhat/atomic-openshift-service-idler<0:4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8

0:4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8

redhat/cri-o<0:1.20.4-7.rhaos4.7.git6287500.el7

0:1.20.4-7.rhaos4.7.git6287500.el7

redhat/ignition<0:2.9.0-4.rhaos4.7.git1d56dc8.el8

0:2.9.0-4.rhaos4.7.git1d56dc8.el8

redhat/openshift<0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el7

0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el7

redhat/openshift-clients<0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8

0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8

redhat/redhat-release-coreos<0:47.84-1.el8

0:47.84-1.el8

redhat/cri-o<0:1.21.2-8.rhaos4.8.git8d4264e.el7

0:1.21.2-8.rhaos4.8.git8d4264e.el7

redhat/ignition<0:2.9.0-7.rhaos4.8.el8

0:2.9.0-7.rhaos4.8.el8

redhat/openshift<0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7

0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7

redhat/openshift-clients<0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7

0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7

redhat/containernetworking-plugins<0:0.8.6-3.rhaos4.6.el7

0:0.8.6-3.rhaos4.6.el7

redhat/cri-tools<0:1.21.0-3.el8

0:1.21.0-3.el8

redhat/golang-github-prometheus-promu<0:0.5.0-4.git642a960.el8

0:0.5.0-4.git642a960.el8

redhat/butane<0:0.12.1-2.rhaos4.8.el8

0:0.12.1-2.rhaos4.8.el8

redhat/mcg<0:5.9.0-28.61dcf87.5.9.el8

0:5.9.0-28.61dcf87.5.9.el8

redhat/etcd<0:3.3.23-7.el8

0:3.3.23-7.el8

redhat/golang-github-vbatts-tar-split<0:0.11.1-6.el8

0:0.11.1-6.el8

redhat/kubevirt<0:2.6.8-211.el7

0:2.6.8-211.el7

redhat/kubevirt<0:4.8.5-278.el7

0:4.8.5-278.el7

redhat/kubevirt<0:2.6.8-211.el8

0:2.6.8-211.el8

redhat/kubevirt<0:4.8.5-278.el8

0:4.8.5-278.el8

redhat/rosa<0:1.1.1-51c4a5e.el8

0:1.1.1-51c4a5e.el8

IBM Security Guardium Insights<=3.0

Golang Go<1.15.14

Golang Go>=1.16.0<1.16.6

Fedoraproject Fedora=33

Fedoraproject Fedora=34

NetApp Cloud Insights Telegraf

NetApp Storagegrid

NetApp Trident

Oracle TimesTen In-Memory Database<21.1.1.1.0

redhat/golang<1.17.0

1.17.0

redhat/golang<1.16.6

1.16.6

redhat/golang<1.15.14

1.15.14

Microsoft cm1 golang 1.16.7-1<1.16.7-1

1.16.7-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/openshift-serverless-clients to a version that resolves this vulnerability.
Fixed in 0:0.23.2-1.el8
Upgrade
Upgrade redhat/go-toolset to a version that resolves this vulnerability.
Fixed in 1.15-0:1.15.14-1.el7_9
Upgrade
Upgrade redhat/go-toolset to a version that resolves this vulnerability.
Fixed in 1.15-golang-0:1.15.14-1.el7_9
Upgrade
Upgrade redhat/grafana to a version that resolves this vulnerability.
Fixed in 0:7.5.9-4.el8
Upgrade
Upgrade redhat/podman to a version that resolves this vulnerability.
Fixed in 2:4.2.0-3.el9
Upgrade
Upgrade redhat/ignition to a version that resolves this vulnerability.
Fixed in 0:2.6.0-8.rhaos4.6.git947598e.el8
Upgrade
Upgrade redhat/atomic-openshift-service-idler to a version that resolves this vulnerability.
Fixed in 0:4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8
Upgrade
Upgrade redhat/cri-o to a version that resolves this vulnerability.
Fixed in 0:1.20.4-7.rhaos4.7.git6287500.el7
Upgrade
Upgrade redhat/ignition to a version that resolves this vulnerability.
Fixed in 0:2.9.0-4.rhaos4.7.git1d56dc8.el8
Upgrade
Upgrade redhat/openshift to a version that resolves this vulnerability.
Fixed in 0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el7
Upgrade
Upgrade redhat/openshift-clients to a version that resolves this vulnerability.
Fixed in 0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8
Upgrade
Upgrade redhat/redhat-release-coreos to a version that resolves this vulnerability.
Fixed in 0:47.84-1.el8
Upgrade
Upgrade redhat/cri-o to a version that resolves this vulnerability.
Fixed in 0:1.21.2-8.rhaos4.8.git8d4264e.el7
Upgrade
Upgrade redhat/ignition to a version that resolves this vulnerability.
Fixed in 0:2.9.0-7.rhaos4.8.el8
Upgrade
Upgrade redhat/openshift to a version that resolves this vulnerability.
Fixed in 0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7
Upgrade
Upgrade redhat/openshift-clients to a version that resolves this vulnerability.
Fixed in 0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7
Upgrade
Upgrade redhat/containernetworking-plugins to a version that resolves this vulnerability.
Fixed in 0:0.8.6-3.rhaos4.6.el7
Upgrade
Upgrade redhat/cri-tools to a version that resolves this vulnerability.
Fixed in 0:1.21.0-3.el8
Upgrade
Upgrade redhat/golang-github-prometheus-promu to a version that resolves this vulnerability.
Fixed in 0:0.5.0-4.git642a960.el8
Upgrade
Upgrade redhat/butane to a version that resolves this vulnerability.
Fixed in 0:0.12.1-2.rhaos4.8.el8
Upgrade
Upgrade redhat/mcg to a version that resolves this vulnerability.
Fixed in 0:5.9.0-28.61dcf87.5.9.el8
Upgrade
Upgrade redhat/etcd to a version that resolves this vulnerability.
Fixed in 0:3.3.23-7.el8
Upgrade
Upgrade redhat/golang-github-vbatts-tar-split to a version that resolves this vulnerability.
Fixed in 0:0.11.1-6.el8
Upgrade
Upgrade redhat/kubevirt to a version that resolves this vulnerability.
Fixed in 0:2.6.8-211.el7
Upgrade
Upgrade redhat/kubevirt to a version that resolves this vulnerability.
Fixed in 0:4.8.5-278.el7
Upgrade
Upgrade redhat/kubevirt to a version that resolves this vulnerability.
Fixed in 0:2.6.8-211.el8
Upgrade
Upgrade redhat/kubevirt to a version that resolves this vulnerability.
Fixed in 0:4.8.5-278.el8
Upgrade
Upgrade redhat/rosa to a version that resolves this vulnerability.
Fixed in 0:1.1.1-51c4a5e.el8
Upgrade
Upgrade redhat/golang to a version that resolves this vulnerability.
Fixed in 1.17.0
Upgrade
Upgrade redhat/golang to a version that resolves this vulnerability.
Fixed in 1.16.6
Upgrade
Upgrade redhat/golang to a version that resolves this vulnerability.
Fixed in 1.15.14
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.16.7-1
Configuration
Disable all TLS_RSA cipher suites (TLS 1.0–1.2 cipher suites without ECDHE) to avoid the affected RSA-based key exchange path.
Go crypto/tls clients TLS_RSA cipher suites = disabled

Event History

Jul 13, 2021

CVE Published

12:00 AM

Jul 15, 2021

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

Description

Jul 19, 2021

Data Sourced

via Red Hat·07:54 AM

DescriptionSeverityAffected Software

Jul 31, 2021

Data Sourced

via Microsoft·07:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this flaw?

The vulnerability ID of this flaw is CVE-2021-34558.

What is the severity of CVE-2021-34558?

The severity of CVE-2021-34558 is medium with a CVSS score of 6.5.

Which software is affected by CVE-2021-34558?

The affected software includes openshift-serverless-clients, go-toolset, grafana, podman, ignition, atomic-openshift-service-idler, cri-o, openshift, openshift-clients, redhat-release-coreos, containernetworking-plugins, cri-tools, golang-github-prometheus-promu, butane, mcg, etcd, golang-github-vbatts-tar-split, kubevirt, rosa, Golang Go, Fedoraproject Fedora, Netapp Cloud Insights Telegraf, Netapp Storagegrid, Netapp Trident, and Oracle TimesTen In-Memory Database.

How can an attacker trigger a panic in the affected software?

An attacker can trigger a panic in the affected software by being in a privileged network position without access to the server certificate's private key.

How can I mitigate the vulnerability?

To mitigate the vulnerability, you should update the affected software to the recommended version provided by the software vendor.

CVE-2021-34558: Input Validation

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the vulnerability ID of this flaw?

What is the severity of CVE-2021-34558?

Which software is affected by CVE-2021-34558?

How can an attacker trigger a panic in the affected software?

How can I mitigate the vulnerability?

Company

Resources

Contact