CVE-2017-8932

06.07.2017, 16:29

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 84%

Vendor	Product	Version
golang	go	𝑥 ≤ 1.7.5
golang	go	1.8
golang	go	1.8.1
opensuse	leap	42.2

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

golang

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
disco	dne
cosmic	dne
bionic	dne
artful	dne
zesty	dne
yakkety	dne
xenial	dne
trusty	dne

golang-1.6

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
disco	dne
cosmic	dne
bionic	dne
artful	dne
zesty	dne
yakkety	ignored
xenial	needed
trusty	dne

golang-1.7

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
disco	dne
cosmic	ignored
bionic	dne
artful	ignored
zesty	ignored
yakkety	ignored
xenial	dne
trusty	dne

golang-1.8

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
disco	dne
cosmic	not-affected
bionic	not-affected
artful	not-affected
zesty	ignored
yakkety	dne
xenial	dne
trusty	dne