5.9

CVE-2017-8932

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Golang ≫ Go Version <= 1.7.5
Golang ≫ Go Version1.8
Golang ≫ Go Version1.8.1
Fedoraproject ≫ Fedora Version25
Opensuse ≫ Leap Version42.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.23% 0.804
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-682 Incorrect Calculation

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

http://lists.opensuse.org/opensuse-updates/2017-06/msg00079.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-06/msg00080.html
Patch
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1859
https://bugzilla.redhat.com/show_bug.cgi?id=1455191
Third Party Advisory
Issue Tracking
https://github.com/golang/go/commit/9294fa2749ffee7edbbb817a0ef9fe633136fa9c
Patch
Third Party Advisory
Issue Tracking
https://github.com/golang/go/issues/20040
Third Party Advisory
https://go-review.googlesource.com/c/41070/
Vendor Advisory
https://groups.google.com/d/msg/golang-announce/B5ww0iFt1_Q/TgUFJV14BgAJ
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZH4T47ROLZ6YEZBDVXVS2KISTDMXAPS/