PT-2016-3937 · Google+1 · Go+1
Ncw
·
Published
2016-01-27
·
Updated
2024-06-15
·
CVE-2015-8618
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Go versions 1.5.0 through 1.5.2
Description
The issue in the math/big library makes it easier for attackers to obtain private RSA keys via unspecified vectors. This can affect RSA computations in crypto/rsa, used by crypto/tls, potentially causing TLS servers on 32-bit systems to leak their RSA private key. The bug can occur at random, around one in 2^26 times on 32-bit systems, allowing an attacker to extract the private key by collecting around 64 million signatures from an affected server. On 64-bit systems, the frequency of the bug is significantly lower, making exploitation very difficult.
Recommendations
For Go versions 1.5.0 through 1.5.2, update to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of RSA computations in crypto/rsa to minimize the risk of exploitation. Avoid using the
crypto/rsa package in TLS servers on 32-bit systems until the issue is resolved.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Go