Incorrect calculation in Go programming language - CVE-2021-3114

Vulnerability identifier: #VU50047

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3114

CWE-ID: CWE-682

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect calculation performed by the application in "crypto/elliptic/p224.go". A remote attacker can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

Go programming language
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
openshift-serverless-clients (Red Hat package)
ignition (Red Hat package)
golang-1.11 (Debian package)
go (Alpine package)
cri-o (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
toolbox (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
coreos-installer (Red Hat package)
python-openshift (Red Hat package)
butane (Red Hat package)
python-pyrsistent (Red Hat package)
console-login-helper-messages (Red Hat package)
python-eventlet (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
rteval-loads (Red Hat package)
delve
golang
golang-tests
golang-src
golang-misc
golang-docs
golang-race
golang-bin
go-toolset
cri-tools (Red Hat package)
NetworkManager (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
python-debtcollector (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-oslo-context (Red Hat package)
python-jsonschema (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-log (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-ironic-lib (Red Hat package)
python-oslo-utils (Red Hat package)
jenkins-2-plugins (Red Hat package)
rust-afterburn (Red Hat package)
python-oslo-i18n (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
grafana (Red Hat package)
python-oslo-db (Red Hat package)
python-oslo-config (Red Hat package)
heketi (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-kubernetes (Red Hat package)
ironic-images (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
ostree (Red Hat package)
Red Hat OpenShift Serverless
OpenShift Virtualization
ObjectScale
Dell PowerProtect Cyber Recovery
Red Hat OpenShift GitOps
QRadar Suite
Red Hat OpenShift Jaeger
IBM Cloud Automation Manager
OpenShift Logging
IBM Robotic Process Automation
Netcool Operations Insight
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
IBM Cloud Pak for Multicloud Management

Install updates from vendor's website.

Go programming language - addressed in versions 1.14.14, 1.15.7
openshift-serverless-clients (Red Hat package) - addressed in versions 0.20.0-6.el8, 0.20.0-7.el8
ignition (Red Hat package) - addressed in versions 2.6.0-7.rhaos4.6.git947598e.el8, 2.9.0-3.rhaos4.7.git1d56dc8.el8, 2.9.0-6.rhaos4.8.el8
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.14.0, 1.14.1
ObjectScale - update to 1.3.0
QRadar Suite - update to 1.10.17.0
golang-1.11 (Debian package) - update to 1.11.6-1+deb10u4
go (Alpine package) - update to 1.15.7-r0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
cri-o (Red Hat package) - addressed in versions 1.19.1-16.rhaos4.6.git130633b.el7, 1.19.1-16.rhaos4.6.git130633b.el8, 1.20.2-3.rhaos4.7.gitfecc319.el7, 1.20.2-3.rhaos4.7.gitfecc319.el8, 1.20.2-11.rhaos4.7.git704b03d.el7, 1.20.2-11.rhaos4.7.git704b03d.el8, 1.21.2-5.rhaos4.8.gitb27d974.el7, 1.21.2-5.rhaos4.8.gitb27d974.el8
openshift-kuryr (Red Hat package) - addressed in versions 4.6.0-202105061806.p0.git.74e6cd2.el8, 4.7.0-202103171728.p0.git.2502.8383c08.el8, 4.7.0-202104250659.p0.git.d49acc4.el8, 4.7.0-202105111743.p0.git.36c2cdd.el8, 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.7.0-202104260636.p0.git.330c6ef.el8, 4.7.0-202105111743.p0.git.39cfc66.el8, 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8
Red Hat OpenShift Container Platform - addressed in versions 4.6.29, 4.7.4, 4.7.9, 4.7.11, 4.7.12, 4.8.2, 4.10.30
openshift-ansible (Red Hat package) - addressed in versions 4.7.0-202103181433.p0.git.0.729df27.el7, 4.7.0-202104250659.p0.git.e1b19c2.el7, 4.7.0-202105111743.p0.git.e1b19c2.el7, 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7
openshift (Red Hat package) - addressed in versions 4.7.0-202103181538.p0.git.97109.7576cdc.el7, 4.7.0-202103181538.p0.git.97109.7576cdc.el8, 4.7.0-202104250659.p0.git.7d0a2b2.el7, 4.7.0-202104250659.p0.git.7d0a2b2.el8, 4.7.0-202105111743.p0.git.75370d3.el7, 4.7.0-202105111743.p0.git.75370d3.el8, 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.7.0-202103191426.p0.git.3953.f3a7513.el7, 4.7.0-202103191426.p0.git.3953.f3a7513.el8, 4.7.0-202104250659.p0.git.95881af.el7, 4.7.0-202104250659.p0.git.95881af.el8, 4.7.0-202105111743.p0.git.95881af.el7, 4.7.0-202105111743.p0.git.95881af.el8, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8
OpenShift Logging - update to 5.0.2
IBM Robotic Process Automation - update to 21.0.3.1
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.8.el8
golang-github-prometheus-promu (Red Hat package) - update to 0.5.0-3.git642a960.el8
coreos-installer (Red Hat package) - update to 0.9.0-6.rhaos4.8.el8
python-openshift (Red Hat package) - update to 0.12.1-1.el8
butane (Red Hat package) - update to 0.12.1-1.rhaos4.8.el8
python-pyrsistent (Red Hat package) - update to 0.16.0-3.el8ost
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.8.el8
python-eventlet (Red Hat package) - update to 0.25.2-4.el8
python-hardware (Red Hat package) - update to 0.27.0-0.20210406121246.756fedb.el8
python-openstacksdk (Red Hat package) - update to 0.53.0-0.20210325011601.4629245.el8
runc (Red Hat package) - addressed in versions 1.0.0-95.rhaos4.8.gitcd80260.el7, 1.0.0-95.rhaos4.8.gitcd80260.el8, 1.0.0-98.rhaos4.8.gitcd80260.el7, 1.0.0-98.rhaos4.8.gitcd80260.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.3.0-0.20210325003851.9f95a6e.el8
rteval-loads (Red Hat package) - update to 1.4-12.el8
delve - update to 1.5.0-2
Migration Toolkit for Containers - update to 1.5.1
Netcool Operations Insight - update to 1.6.6
golang - addressed in versions 1.15.7-1.fc33, 1.15.14-1.el7
golang-tests - update to 1.15.14-1
golang-src - update to 1.15.14-1
golang-misc - update to 1.15.14-1
golang-docs - update to 1.15.14-1
golang-race - update to 1.15.14-1
golang-bin - update to 1.15.14-1
golang - update to 1.15.14-1
go-toolset - update to 1.15.14-1
cri-tools (Red Hat package) - addressed in versions 1.20.0-2.el7, 1.20.0-2.el8, 1.21.0-2.el7, 1.21.0-2.el8
NetworkManager (Red Hat package) - update to 1.26.0-14.1.rhaos4.7.el8
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326152858.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-4.el8
python-debtcollector (Red Hat package) - update to 2.2.0-0.20210324220630.649189d.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.2.1-0.20210325143713.70e39c8.el8
haproxy (Red Hat package) - addressed in versions 2.2.13-1.el7, 2.2.13-1.el8
IBM Cloud Pak for Multicloud Management - update to 2.3.1
python-oslo-service (Red Hat package) - update to 2.5.0-0.20210325014731.d25e454.el8
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0, 4.9.0
python-tooz (Red Hat package) - update to 2.8.0-0.20210324235001.54448e9.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-9.el8fdp
jenkins (Red Hat package) - addressed in versions 2.277.3.1620393611-1.el8, 2.289.1.1624020353-1.el8
podman (Red Hat package) - update to 3.0.1-6.el8
python-oslo-context (Red Hat package) - update to 3.2.0-0.20210325043103.0d02866.el8
python-jsonschema (Red Hat package) - update to 3.2.0-5.el8ost
python-stevedore (Red Hat package) - update to 3.3.0-0.20210325001012.7d7154f.el8
python-oslo-policy (Red Hat package) - update to 3.7.0-0.20210325051823.d853485.el8
python-sushy (Red Hat package) - update to 3.7.1-0.20210428165244.bc49878.el8
python-oslo-serialization (Red Hat package) - update to 4.1.0-0.20210325012242.8445e61.el8
python-keystoneauth1 (Red Hat package) - update to 4.3.0-0.20210325001456.6a66271.el8
python-oslo-log (Red Hat package) - addressed in versions 4.4.0-0.20210310191258.9b29c90.el8, 4.4.0-0.20210409081224.9b29c90.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.0-0.20210325004915.7dcf9e9.el8
python-ironic-lib (Red Hat package) - addressed in versions 4.4.1-0.20210129211219.7ac01e1.el8, 4.6.2-0.20210608101214.ca2e4ba.el8
python-oslo-utils (Red Hat package) - update to 4.8.0-0.20210325043201.3288539.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1624022417-1.el8
rust-afterburn (Red Hat package) - update to 5.0.0-1.rhaos4.8.el8
python-oslo-i18n (Red Hat package) - update to 5.0.1-0.20210324221600.73187bd.el8
openstack-ironic-python-agent (Red Hat package) - addressed in versions 6.4.4-0.20210310142329.99b9953.el8, 7.0.2-0.20210611153100.bfa97cb.el8
grafana (Red Hat package) - update to 7.5.9-4.el8
python-oslo-db (Red Hat package) - update to 8.5.0-0.20210325041241.503db60.el8
python-oslo-config (Red Hat package) - update to 8.5.0-0.20210325050501.cfa2564.el8
heketi (Red Hat package) - update to 10.4.0-2.el7rhgs
openstack-ironic-inspector (Red Hat package) - update to 10.6.1-0.20210406091336.579f59c.el8
python-kubernetes (Red Hat package) - update to 12.0.1-1.el8
ironic-images (Red Hat package) - addressed in versions 15.2-20210315.1.el8, 2021.1-20210614.1.el8
openstack-ironic (Red Hat package) - addressed in versions 16.0.4-0.20210510131210.6787142.el8, 17.0.4-0.20210713221218.a415e7e.el8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
ovn2.13 (Red Hat package) - update to 20.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 48.84-4.el8
ostree (Red Hat package) - update to 2020.7-5.el8_4

• https://github.com/golang/go/commit/d95ca9138026cbe40e0857d76a81a16d03230871
• https://groups.google.com/g/golang-announce/c/mperVMGa98w

• Multiple vulnerabilities in Go
• Arch Linux update for go
• Incorrect calculation in go (Alpine package)
• Debian update for golang-1.11
• Multiple vulnerabilities in Red Hat Openshift Serverless Client
• Red Hat OpenShift Serverless update for golang
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Incorrect calculation in Openshift Logging
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in OpenShift Serverless Client
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Red Hat OpenShift Container Platform update for Golang
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Red Hat OpenShift Virtualization update for golang
• Multiple vulnerabilities in OpenShift Container Storage 3.11.z
• OpenShift Container Platform 4.6 update for go
• Gentoo update for Go
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in Netcool Operations Insight
• Red Hat Enterprise Linux 8 update for grafana
• Incorrect calculation in IBM Cloud Automation Manager
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Incorrect calculation in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8 packages
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Fedora 33 update for golang
• Fedora EPEL 7 update for golang
• Anolis OS update for go-toolset:an8 module
• Multiple vulnerabilities in Dell ObjectScale