https://bugzilla.redhat.com/show_bug.cgi?id=1293448
Bug ID: 1293448
Summary: golang: Carry propagation in Int.Exp Montgomery code
in math/big library
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aavati(a)redhat.com, admiller(a)redhat.com,
bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com, golang(a)lists.fedoraproject.org,
jcajka(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lemenkov(a)gmail.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
nlevinki(a)redhat.com, renich(a)woralelandia.com,
rfortier(a)redhat.com, rhs-bugs(a)redhat.com,
sgirijan(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com, s(a)shk.io, vbatts(a)redhat.com,
vbellur(a)redhat.com
Carry propagation in Int.Exp Montgomery function was found in golang's math/big
library, similar to CVE-2015-3193. This issue was introduced in the 1.5 release
and remains present in 1.5.1 and 1.5.2.
Upstream patch:
https://go-review.googlesource.com/#/c/17672/
CVE request:
http://seclists.org/oss-sec/2015/q4/550
--
You are receiving this mail because:
You are on the CC list for the bug.