PT-2021-6078 · Go+6 · Go+6
Published
2021-02-19
·
Updated
2025-09-29
·
CVE-2021-34558
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions through 1.16.5
Description
The issue arises from insufficient certificate authentication in the crypto/tls package of the Go programming language. This can be exploited by a remote attacker to cause a denial of service. Specifically, when doing an RSA-based key exchange, a malicious TLS server can cause a TLS client to panic by providing an X.509 certificate with a public key type that does not match the expected type.
Recommendations
For versions through 1.16.5, consider updating to a version that properly asserts the type of public key in an X.509 certificate matches the expected type when doing a key exchange. As a temporary workaround, restrict the use of RSA-based key exchange until a patch is available. Additionally, be cautious when providing certificates to avoid causing a panic in TLS clients. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Go
Red Hat
Rocky Linux
Suse