Skip to content
OpenAdvisories
Unscored RHSA-2021:3015 1 CVE

Red Hat Security Advisory: go-toolset-1.15 and go-toolset-1.15-golang security and bug fix update

Published Sep 29, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-build 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-golang 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-golang-bin 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-golang-docs 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-golang-misc 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-golang-race 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-golang-src 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-golang-tests 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-runtime 0:1.15.14-1.el7_9
Red Hat · Devtools 2021 devtools:2021 go-toolset-1.15-scldevel 0:1.15.14-1.el7_9

Vulnerabilities 1

  • Unscored —
    CVE-2021-34558 Public exploit

    Panic on certain certificates in crypto/tls

    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.15.7_toolset
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1983596
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3015.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-34558
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-34558
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-34558
  • article
    https://golang.org/doc/devel/release#go1.15.minor
  • article
    https://golang.org/doc/devel/release#go1.16.minor