Skip to content
OpenAdvisories
Medium RHSA-2021:3076 4 CVEs

Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

Published Oct 21, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream delve 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debuginfo 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debugsource 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
Red Hat · RHEL 8 enterprise_linux:8::appstream go-toolset 0:1.15.14-1.module+el8.4.0+11833+614b07b8
Red Hat · RHEL 8 enterprise_linux:8::appstream golang 0:1.15.14-1.module+el8.4.0+11833+614b07b8
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-bin 0:1.15.14-1.module+el8.4.0+11833+614b07b8
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-docs 0:1.15.14-1.module+el8.4.0+11833+614b07b8
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-misc 0:1.15.14-1.module+el8.4.0+11833+614b07b8
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-race 0:1.15.14-1.module+el8.4.0+11833+614b07b8
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-src 0:1.15.14-1.module+el8.4.0+11833+614b07b8
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-tests 0:1.15.14-1.module+el8.4.0+11833+614b07b8

Vulnerabilities 4

  • Medium 5.9
    CVE-2021-31525

    golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion

    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

    go stdlib k3d golang-1.16 Debian Ubuntu Alpine Wolfi Go
  • Unscored —
    CVE-2021-27918

    Infinite loop when decoding inputs in encoding/xml

    encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-33196

    Panic when reading certain archives in archive/zip

    In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-34558 Public exploit

    Panic on certain certificates in crypto/tls

    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.15.7_toolset
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1937901
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1958341
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1965503
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1978567
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1983596
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3076.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-27918
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-27918
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-27918
  • article
    https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw
  • report
    https://access.redhat.com/security/cve/CVE-2021-31525
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-31525
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-31525
  • article
    https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc
  • report
    https://access.redhat.com/security/cve/CVE-2021-33196
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-33196
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-33196
  • article
    https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
  • report
    https://access.redhat.com/security/cve/CVE-2021-34558
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-34558
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-34558
  • article
    https://golang.org/doc/devel/release#go1.15.minor
  • article
    https://golang.org/doc/devel/release#go1.16.minor