PT-2019-1350 · Go+2 · Go+2
Published
2018-09-07
·
Updated
2024-06-15
·
CVE-2019-6486
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions prior to 1.10.8
Go versions 1.11.x prior to 1.11.5
Description
The issue exists due to insufficient input validation in the crypto module of the Go programming language. This can be exploited by a remote attacker to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks. The vulnerability is related to the mishandling of P-521 and P-384 elliptic curves. Attackers can craft inputs that consume excessive amounts of CPU, which might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares, or ECDSA signatures.
Recommendations
For Go versions prior to 1.10.8, update to version 1.10.8 or later to resolve the issue.
For Go versions 1.11.x prior to 1.11.5, update to version 1.11.5 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
crypto/elliptic module, specifically the P-521 and P-384 elliptic curves, until a patch is available. Avoid reusing ECDH private keys to minimize the risk of key recovery attacks.Exploit
Fix
DoS
RCE
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Go
Suse