Bug 676368 (CVE-2019-6486)

Summary:	<dev-lang/go-{1.10.8,1.11.5}: crypto/elliptic implementations of P-521 and P-384 elliptic curves allow for denial of service (CVE-2019-6486)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	williamh
Priority:	Normal	Flags:	stable-bot: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [noglsa cve]
Package list:	dev-lang/go-1.10.8 dev-lang/go-1.11.5	Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2019-01-26 22:49:02 UTC

CVE-2019-6486 (https://nvd.nist.gov/vuln/detail/CVE-2019-6486):
  Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384
  elliptic curves, which allows attackers to cause a denial of service (CPU
  consumption) or possibly conduct ECDH private key recovery attacks.

Comment 1 William Hubbs gentoo-dev

2019-01-30 21:39:37 UTC

Arm team, please stabilize.

Thanks,

William

Comment 2 Markus Meier gentoo-dev

2019-01-31 20:21:16 UTC

arm stable, all arches done.

Comment 3 William Hubbs gentoo-dev

2019-02-13 15:33:52 UTC

Stabilization and cleanup are done.

Comment 4 Yury German Gentoo Infrastructure

2019-03-27 02:47:11 UTC

GLSA Vote: No

Arches and Maintainer(s), Thank you for your work.