CVE-2022-23806

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

Published Feb 11, 2022 CVSS 3.1 · 9.1 Critical EPSS 3.1% KEV · Not listed
Description
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2985-1 golang-1.7 security update
Debian DLA Debian DLA DLA-2986-1 golang-1.8 security update
Debian DLA Debian DLA DLA-3395-1 golang-1.11 security update
EUVD EUVD EUVD-2022-28738 Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
History
Type Values Removed Values Added
First Time appeared Redhat stf
CPEs cpe:/a:redhat:service_telemetry_framework:1.5::el8 cpe:/a:redhat:stf:1.5::el8
Vendors & Products Redhat service Telemetry Framework
Redhat stf
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8