CVE-2021-34558: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 7% chance of exploitation in the next 30 days.

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only
• Golang Go: before 1.15.14 (fixed in 1.15.14); from 1.16.0, before 1.16.6 (fixed in 1.16.6)
• Netapp Cloud Insights Telegraf: affected versions not specified
• Netapp Storagegrid: affected versions not specified
• Netapp Trident: affected versions not specified
• Oracle Timesten In-Memory Database: before 21.1.1.1.0 (fixed in 21.1.1.1.0)

Published 2021-07-15. Last modified 2026-06-17.