CVE-2021-3114: Medium severity IBM Cloud Pak for Security vulnerability
A flaw detected in golang: crypto/elliptic, in which P-224 keys as generated can return incorrect inputs, reducing the strength of the cryptography. The highest threat from this vulnerability is confidentiality and integrity.
Other sources
An unspecified error with the P224() Curve implementation can generate incorrect outputs in Golang Go has an unknown impact and attack vector.
— IBM
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages support P-224 ECDSA keys, but they are not supported by publicly trusted certificate authorities. No other standard library or golang.org/x/crypto package supports or uses the P-224 curve.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:0308
- RHBA-2021:1167
- RHSA-2021:2021
- RHSA-2021:1338
- RHSA-2021:2093
- RHSA-2021:1339
- RHSA-2021:2095
- RHSA-2021:1746
- RHSA-2021:4226
- RHBA-2021:1522
- RHSA-2021:0958
- RHSA-2021:1006
- RHSA-2021:1551
- RHBA-2021:0959
- RHSA-2021:0957
- RHSA-2021:1366
- RHSA-2021:2437
- RHSA-2021:2438
- RHSA-2021:2041
- RHSA-2021:3119
- RHSA-2021:4103
- IBM-7080058
Frequently Asked Questions
What is CVE-2021-3114?
CVE-2021-3114 is an unspecified error with the P224() Curve implementation in Golang.
What is the severity of CVE-2021-3114?
CVE-2021-3114 has a severity score of 6.5 (Medium).
Which software is affected by CVE-2021-3114?
The affected software includes Golang versions 1.11, 1.15, and Red Hat Go.
How can I fix CVE-2021-3114?
To fix CVE-2021-3114, update your Golang installation to the recommended versions or apply the provided patches.
What is the impact of CVE-2021-3114?
The highest threat from CVE-2021-3114 is to confidentiality and integrity.