Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/elliptic: IsOnCurve returns true for invalid field elements [1.17 backport] #50978

Closed
gopherbot opened this issue Feb 2, 2022 · 3 comments
Closed

crypto/elliptic: IsOnCurve returns true for invalid field elements [1.17 backport] #50978

gopherbot opened this issue Feb 2, 2022 · 3 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Milestone
Go1.17.7

Comments

@gopherbot
Copy link
Contributor

@FiloSottile requested issue #50974 to be considered for backport to the next 1.17 minor release.

@gopherbot please open backport issues for this security fix. /cc @golang/security
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Feb 2, 2022
@gopherbot gopherbot mentioned this issue Feb 2, 2022
Closed
@gopherbot gopherbot added this to the Go1.17.7 milestone Feb 2, 2022
@gopherbot

This comment was marked as duplicate.

Sign in to view
@gopherbot
Copy link
Contributor Author

Change https://golang.org/cl/382854 mentions this issue: [release-branch.go1.17] crypto/elliptic: make IsOnCurve return false for invalid field elements

@toothrot toothrot added the CherryPickApproved Used during the release process for point releases label Feb 3, 2022
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Feb 3, 2022
@gopherbot
Copy link
Contributor Author

Closed by merging e163319 to release-branch.go1.17.

gopherbot pushed a commit that referenced this issue Feb 7, 2022
@FiloSottile @cherrymui
[release-branch.go1.17] crypto/elliptic: make IsOnCurve return false …
e163319 
…for invalid field elements

Updates #50974
Fixes #50978
Fixes CVE-2022-23806

Change-Id: I0201c2c88f13dd82910985a495973f1683af9259
Reviewed-on: https://go-review.googlesource.com/c/go/+/382854
Trust: Filippo Valsorda <[email protected]>
Run-TryBot: Filippo Valsorda <[email protected]>
Reviewed-by: Katie Hockman <[email protected]>
Trust: Katie Hockman <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
@knz knz mentioned this issue May 25, 2022
Closed
@golang golang locked and limited conversation to collaborators Feb 7, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Projects
None yet
Milestone
Go1.17.7
Development

No branches or pull requests
2 participants
@toothrot @gopherbot