GO-2021-0235
Incorrect operations on the P-224 curve in crypto/elliptic
At a glance
- Published
- Updated
- CVE
- CVE-2021-3114
- Aliases
- BIT-golang-2021-3114
Description
The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.14.14, introduced 1.15.0-0, fixed 1.15.7 |
References
- https://go.dev/cl/284779 FIX
- https://go.googlesource.com/go/+/d95ca9138026cbe40e0857d76a81a16d03230871 FIX
- https://go.dev/issue/43786 REPORT
- https://groups.google.com/g/golang-announce/c/mperVMGa98w WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |