# Impact of CVE-2021-3114 and CVE-2021-3115 on Mender

**URL:** https://hub.mender.io/t/impact-of-cve-2021-3114-and-cve-2021-3115-on-mender/3176
**Category:** General Discussions
**Created:** [February 4, 2021, 9:10am UTC](https://hub.mender.io/t/impact-of-cve-2021-3114-and-cve-2021-3115-on-mender/3176 "2021-02-04T09:10:36Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![deffo](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@deffo](https://hub.mender.io/u/deffo)
#### Post date: [February 4, 2021, 9:10am UTC](https://hub.mender.io/t/impact-of-cve-2021-3114-and-cve-2021-3115-on-mender/3176/1 "2021-02-04T09:10:36Z")

</div>

Hi there!

How do you consider the impact of CVE-2021-3114 [1] and CVE-2021-3115 [2] on Mender? Do you think this is critical? We are asking since warrior-v2020.10 is directly affected with version 1.14.7.

Best regards

[1] [NVD - CVE-2021-3114](https://nvd.nist.gov/vuln/detail/CVE-2021-3114)  
[2] [NVD - CVE-2021-3115](https://nvd.nist.gov/vuln/detail/CVE-2021-3115)

---

<div class="post-metadata">

### Author: ![drewmoseley](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/drewmoseley/32/47_2.png) [@drewmoseley](https://hub.mender.io/u/drewmoseley)
#### Post date: [February 4, 2021, 1:56pm UTC](https://hub.mender.io/t/impact-of-cve-2021-3114-and-cve-2021-3115-on-mender/3176/2 "2021-02-04T13:56:19Z")

</div>

Another one for your review @kacf.

---

<div class="post-metadata">

### Author: ![kacf](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/kacf/32/146_2.png) [@kacf](https://hub.mender.io/u/kacf)
#### Post date: [February 5, 2021, 8:01am UTC](https://hub.mender.io/t/impact-of-cve-2021-3114-and-cve-2021-3115-on-mender/3176/3 "2021-02-05T08:01:52Z")

</div>

> [@deffo](#):
>
> NVD - CVE-2021-3114

Perhaps @eystein can confirm, but I’m pretty sure Mender is not affected. Mender only uses RSA and the ED25519 curve.

> [@deffo](#):
>
> NVD - CVE-2021-3115

Definitely not affected. Mender vendors all dependencies and does not rely on `go get`. In any case, this is a build time vulnerability, it does not affect deployed binaries.

---

<div class="post-metadata">

### Author: ![eystein](https://avatars.discourse-cdn.com/v4/letter/e/e5b9ba/32.png) [@eystein](https://hub.mender.io/u/eystein)
#### Post date: [February 5, 2021, 4:46pm UTC](https://hub.mender.io/t/impact-of-cve-2021-3114-and-cve-2021-3115-on-mender/3176/4 "2021-02-05T16:46:07Z")

</div>

Hello @deffo

Thanks for bringing this up.

[NVD - CVE-2021-3114](https://nvd.nist.gov/vuln/detail/CVE-2021-3114)

This seems to me to only affect the NIST P-224 elliptic curve use in Golang, as it refers to the file crypto/elliptic/p224.go.

If this is the case then Mender should not be affected:

- Artifact sigatures support NIST P-256 and RSA
- Communication uses TLS, and so it is theoretically possible to configure TLS to use this curve. Though this is not done by default in Mender (on-premise demo setup uses P-256 and hosted Mender uses RSA). This is also a very rare curve to use, I believe.