Skip to content
OpenAdvisories
Unscored RHSA-2021:1746 2 CVEs

Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

Published Sep 18, 2024 · Updated Aug 8, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream delve 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debuginfo 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debugsource 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
Red Hat · RHEL 8 enterprise_linux:8::appstream go-toolset 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
Red Hat · RHEL 8 enterprise_linux:8::appstream golang 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-bin 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-docs 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-misc 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-race 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-src 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-tests 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24

Vulnerabilities 2

  • Unscored —
    CVE-2021-3114

    Incorrect operations on the P-224 curve in crypto/elliptic

    In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-3115

    Arbitrary code injection via the go command with cgo on Windows in cmd/go

    Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

    go python-tensorboard toolchain golang-1.15 Debian Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1918750
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1918761
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1746.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3114
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3114
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3114
  • article
    https://groups.google.com/g/golang-announce/c/mperVMGa98w
  • report
    https://access.redhat.com/security/cve/CVE-2021-3115
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3115
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3115