An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

  - atomic-openshift: cross-namespace owner references can trigger deletions of valid children (CVE-2019-3884)

  - kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

  - containerd: credentials leak during image pull (CVE-2020-15157)

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1006 advisory.

  - golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

  - fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise     (CVE-2021-20218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2437 advisory.

  - golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

  - openshift: Injected service-ca.crt incorrectly contains additional internal CAs (CVE-2021-3636)

  - python-eventlet: improper handling of highly compressed data and memory allocation with excessive size     allows DoS (CVE-2021-21419)

  - jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin     (CVE-2021-21623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02977-1 advisory.

    - Update to version 1.18.20:
    - CVE-2021-3121: Fixed a lack of certain index validation in plugin/unmarshal/unmarshal.go. (bsc#1182185)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index     validation, aka the skippy peanut butter issue. (CVE-2021-3121)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index
    validation, aka the "skippy peanut butter" issue. (CVE-2021-3121)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1276 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    This advisory covers the RPM packages for the release.

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * envoy: Incorrect configuration handling allows mTLS session re-use without re-validation     (CVE-2022-21654)

    * envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655)

    * istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)

    * nodejs-axios: Regular expression denial of service in trim function (CVE-2021-3749)

    * ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)

    * golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet     (CVE-2021-29923)

    * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

    * golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)

    * envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824)

    * envoy: Use-after-free when response filters increase response data (CVE-2021-43825)

    * envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)

    * envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606)

    * istio: unauthenticated control plane denial of service attack (CVE-2022-23635)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of CockroachDB installed on the remote host is prior to 19.2.12, 20.1.x prior to 20.1.11, or 20.2.x prior  to 20.2.4. Therefore, a denial of service (DoS) vulnerability exists in protobuf binary decode functions. An  unauthenticated, remote attacker can exploit this issue by sending a specially crafted HTTP request to cause the  full-cluster to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the consul package has been released.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2437 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.2. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2021:2438

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

    * openshift: Injected service-ca.crt incorrectly contains additional internal CAs (CVE-2021-3636)

    * python-eventlet: improper handling of highly compressed data and memory allocation with excessive size     allows DoS (CVE-2021-21419)

    * jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin     (CVE-2021-21623)

    * jenkins-2-plugins/credentials: Reflected XSS vulnerability in Credentials Plugin (CVE-2021-21648)

    * kubernetes: Validating Admission Webhook does not observe some previous fields (CVE-2021-25735)

    * jenkins: lack of type validation in agent related REST API (CVE-2021-21639)

    * jenkins: view name validation bypass (CVE-2021-21640)

    * kubernetes: Holes in EndpointSlice Validation Enable Host Network Hijack (CVE-2021-25737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.8 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1006 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.7.5. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:1005

    All OpenShift Container Platform 4.7 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift Console     or the CLI oc command. Instructions for upgrading a cluster are available     at     https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Placeholder bug for OCP 4.7.0 rpm release (BZ#1944016)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.7.0. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2020:5633

    All OpenShift Container Platform 4.7 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift Console     or the CLI oc command. Instructions for upgrading a cluster are available     at     https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

    * containerd: credentials leak during image pull (CVE-2020-15157)

    * python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    * atomic-openshift: cross-namespace owner references can trigger deletions of valid children     (CVE-2019-3884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
312575	RHCOS 4 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	high
312454	RHCOS 4 : OpenShift Container Platform 4.7.5 (RHSA-2021:1006)	Nessus	Red Hat Local Security Checks	high
312421	RHCOS 4 : OpenShift Container Platform 4.8.2 (RHSA-2021:2437)	Nessus	Red Hat Local Security Checks	medium
255206	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.18 (SUSE-SU-2025:02977-1)	Nessus	SuSE Local Security Checks	high
250903	Linux Distros Unpatched Vulnerability : CVE-2021-3121	Nessus	Misc.	high
424421	Alpine: multiple protobuf-c packages: security update to 1.3.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424421	Alpine: multiple protobuf-c packages: security update to 1.3.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
413621	SCA: security update for github.com/gogo/protobuf (GHSA-c3h9-896r-86jm)	Tenable Cloud Security	SCA Checks	high
413621	SCA: security update for github.com/gogo/protobuf (GHSA-c3h9-896r-86jm)	Tenable Self-Hosted Container Security	SCA Checks	high
159603	RHEL 8 : Red Hat OpenShift Service Mesh 2.0.9 (RHSA-2022:1276)	Nessus	Red Hat Local Security Checks	critical
159484	CockroachDB 19.2 < 19.2.12 / 20.1 < 20.1.11 / 20.2 < 20.2.4 DoS (A58932)	Nessus	Databases	high
153751	Photon OS 3.0: Consul PHSA-2021-3.0-0303	Nessus	PhotonOS Local Security Checks	high
153745	Photon OS 4.0: Consul PHSA-2021-4.0-0105	Nessus	PhotonOS Local Security Checks	high
152103	RHEL 7 / 8 : OpenShift Container Platform 4.8.2 (RHSA-2021:2437)	Nessus	Red Hat Local Security Checks	high
148316	RHEL 7 / 8 : OpenShift Container Platform 4.7.5 (RHSA-2021:1006)	Nessus	Red Hat Local Security Checks	high
146810	RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-3121

high

Tenable Plugins

high

high

medium

high

high

high

high

high

high

critical

high

high

high

high

high

high