openSUSE-SU-2021:2392-1

    Dashboard / Vulnerabilities / openSUSE-SU-2021:2392-1

    openSUSE-SU-2021:2392-1

    Published: 19 Jul 2021Last Modified: 4 Feb 2026
    Upstream:
    CVE-2021-34558

    Summary: Security update for go1.16

    Details: This update for go1.16 fixes the following issues: go1.16.6 (released 2021-07-12, bsc#1182345) includes a security fix to the crypto/tls package, as well as bug fixes to the compiler, and the net and net/http packages. Security issue fixed: CVE-2021-34558: Fixed crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters (bsc#1188229) go1.16 release: * bsc#1188229 go#47143 CVE-2021-34558 * go#47145 security: fix CVE-2021-34558 * go#46999 net: LookupMX behaviour broken * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3 * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora * go#46657 runtime: deeply nested struct initialized with non-zero values * go#44984 net/http: server not setting Content-Length in certain cases

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/AKQH4LHYIFOWBEGMGHD7S7TTV7JL4U7W/, https://bugzilla.suse.com/1182345, https://bugzilla.suse.com/1188229, https://www.suse.com/security/cve/CVE-2021-34558

    Affected packages

    Package

    Name: go1.16

    Purl: pkg:rpm/opensuse/go1.16&distro=openSUSE%20Leap%2015.3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.16.6-1.20.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2021:2392-1 | CVE-DB