Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 676368 (CVE-2019-6486) - <dev-lang/go-{1.10.8,1.11.5}: crypto/elliptic implementations of P-521 and P-384 elliptic curves allow for denial of service (CVE-2019-6486)
Summary: <dev-lang/go-{1.10.8,1.11.5}: crypto/elliptic implementations of P-521 and P-...
Status: RESOLVED FIXED
Alias: CVE-2019-6486
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-26 22:49 UTC by GLSAMaker/CVETool Bot
Modified: 2019-03-27 02:47 UTC (History)
1 user (show)

See Also:
Package list:
dev-lang/go-1.10.8 dev-lang/go-1.11.5
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-01-26 22:49:02 UTC 
CVE-2019-6486 (https://nvd.nist.gov/vuln/detail/CVE-2019-6486):
  Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384
  elliptic curves, which allows attackers to cause a denial of service (CPU
  consumption) or possibly conduct ECDH private key recovery attacks.
Comment 1 William Hubbs gentoo-dev 2019-01-30 21:39:37 UTC 
Arm team, please stabilize.

Thanks,

William
Comment 2 Markus Meier gentoo-dev 2019-01-31 20:21:16 UTC 
arm stable, all arches done.
Comment 3 William Hubbs gentoo-dev 2019-02-13 15:33:52 UTC 
Stabilization and cleanup are done.
Comment 4 Yury German Gentoo Infrastructure gentoo-dev 2019-03-27 02:47:11 UTC 
GLSA Vote: No

Arches and Maintainer(s), Thank you for your work.