Vulnerability Report: GO-2022-0435
- CVE-2022-28327
- Affects: crypto/elliptic
- Published: May 20, 2022
- Modified: Jun 12, 2023
A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.
Affected Packages
-
PathVersionsSymbols
-
before go1.17.9, from go1.18.0-0 before go1.18.1
Aliases
References
- https://go.dev/cl/397135
- https://go.googlesource.com/go/+/37065847d87df92b5eb246c88ba2085efcf0b331
- https://go.dev/issue/52075
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8
- https://vuln.go.dev/ID/GO-2022-0435.json
Credits
- Project Wycheproof
Feedback
See anything missing or incorrect?
Suggest an edit to this report.