{"id":"CVE-2017-8932","aliases":["BELL-CVE-2017-8932","EUVD-2017-17872","GHSA-25hf-x7c8-5f3h","GO-2022-0187","MGASA-2017-0195","RHSA-2017:1859","SUSE-RU-2017:1965-1","UBUNTU-CVE-2017-8932","openSUSE-SU-2017:1649-1","openSUSE-SU-2017:1650-1","openSUSE-SU-2024:10802-1","openSUSE-SU-2024:10803-1","openSUSE-SU-2024:10804-1","openSUSE-SU-2024:10805-1","openSUSE-SU-2024:10812-1"],"status":"published","title":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in...","description":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02225,"percentile":0.8283,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-682"],"published":"2017-06-22T12:29:57Z","modified":"2026-10-20T10:49:34Z","fixes":[{"ecosystem":"Go","package":"stdlib","fixed_in":["1.7.6","1.8.2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"golang","fixed_in":["1.6.4-2.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"containerd","fixed_in":["0.2.5+gitr639_422e31c-20.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"docker","fixed_in":["17.04.0_ce-98.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"golang-github-docker-libnetwork","fixed_in":["0.0.0+git20170119.7b2b1fe-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"runc","fixed_in":["0.1.1+gitr2947_9c2d8d1-20.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","fixed_in":["0.2.5+gitr639_422e31c-20.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","fixed_in":["17.04.0_ce-98.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-distribution","fixed_in":["2.6.1-15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"golang-github-docker-libnetwork","fixed_in":["0.0.0+git20170119.7b2b1fe-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","fixed_in":["0.1.1+gitr2947_9c2d8d1-20.3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12","package":"go","fixed_in":["1.7.0-12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0-0"},{"fixed":"1.7.6"},{"introduced":"1.8.0-0"},{"fixed":"1.8.2"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-2.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5+gitr639_422e31c-20.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.04.0_ce-98.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git20170119.7b2b1fe-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1+gitr2947_9c2d8d1-20.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5+gitr639_422e31c-20.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.04.0_ce-98.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git20170119.7b2b1fe-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1+gitr2947_9c2d8d1-20.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-10.5"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.17-4.8"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-11.2"}]}],"bundled":9}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"go"},{"vendor":"novell","product":"suse_package_hub_for_suse_linux_enterprise"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://groups.google.com/d/msg/golang-announce/B5ww0iFt1_Q/TgUFJV14BgAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/golang/go/commit/9294fa2749ffee7edbbb817a0ef9fe633136fa9c","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1859","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-06/msg00080.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-06/msg00079.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455191","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/golang/go/issues/20040","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://go-review.googlesource.com/c/41070/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZH4T47ROLZ6YEZBDVXVS2KISTDMXAPS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8932","tags":["advisory"]},{"url":"https://go-review.googlesource.com/c/41070"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZH4T47ROLZ6YEZBDVXVS2KISTDMXAPS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZH4T47ROLZ6YEZBDVXVS2KISTDMXAPS"},{"url":"https://github.com/advisories/GHSA-25hf-x7c8-5f3h"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-8932","tags":["advisory"]},{"url":"https://go.dev/cl/41070","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/9294fa2749ffee7edbbb817a0ef9fe633136fa9c","tags":["fix"]},{"url":"https://go.dev/issue/20040","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/B5ww0iFt1_Q/m/TgUFJV14BgAJ","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0195.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21103","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LZH4T47ROLZ6YEZBDVXVS2KISTDMXAPS/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1405587","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455189","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1859.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8932","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1401985","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000098","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20171965-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1026827","tags":["report"]},{"url":"https://bugzilla.suse.com/1028113","tags":["report"]},{"url":"https://bugzilla.suse.com/1028638","tags":["report"]},{"url":"https://bugzilla.suse.com/1028639","tags":["report"]},{"url":"https://bugzilla.suse.com/1030702","tags":["report"]},{"url":"https://bugzilla.suse.com/1032287","tags":["report"]},{"url":"https://bugzilla.suse.com/1032644","tags":["report"]},{"url":"https://bugzilla.suse.com/1032769","tags":["report"]},{"url":"https://bugzilla.suse.com/1034053","tags":["report"]},{"url":"https://bugzilla.suse.com/1034063","tags":["report"]},{"url":"https://bugzilla.suse.com/1037436","tags":["report"]},{"url":"https://bugzilla.suse.com/1037607","tags":["report"]},{"url":"https://bugzilla.suse.com/1038476","tags":["report"]},{"url":"https://bugzilla.suse.com/1038493","tags":["report"]},{"url":"https://bugzilla.suse.com/1040618","tags":["report"]},{"url":"https://bugzilla.suse.com/953182","tags":["report"]},{"url":"https://bugzilla.suse.com/964546","tags":["report"]},{"url":"https://bugzilla.suse.com/996303","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-8932","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-8932","description":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","status":"published","published":"2017-07-06T16:00:00Z","modified":"2024-08-05T16:48:22.902Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-17872","description":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","status":"published","published":"2017-07-06T16:00:00Z","modified":"2024-08-05T16:48:22Z","updated_at":"2026-11-03T02:23:29.187521Z"}],"ghsa":[{"id":"GHSA-25hf-x7c8-5f3h","title":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in...","description":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","status":"published","published":"2022-05-13T01:47:46Z","modified":"2025-04-20T03:41:22Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:01:49.006624Z"}],"nvd":[{"id":"CVE-2017-8932","description":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","status":"published","published":"2017-07-06T16:29:00.42Z","modified":"2026-06-17T01:27:13.483Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"BELL-CVE-2017-8932","title":"CVE-2017-8932 does not affect BellSoft software","status":"withdrawn","published":"2017-07-06T16:29:00Z","modified":"2026-01-26T09:50:10.841918Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2017-8932","description":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","status":"published","published":"2017-07-06T16:29:00.42Z","modified":"2026-10-20T10:49:34.681246657Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"RHSA-2017:1859","title":"Red Hat Security Advisory: golang security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:57:08Z","modified":"2026-05-13T10:36:18.779579Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-8932","description":"A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","status":"published","published":"2017-07-06T16:29:00Z","modified":"2025-10-24T04:46:19Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"GO-2022-0187","title":"Incorrect computation for P-256 curves in crypto/elliptic","description":"The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.","status":"published","published":"2022-07-01T20:11:15Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2017-0195","title":"Updated golang packages fix security vulnerability","description":"A carry propagation issue was found in the P-256 implementation for x86-64\nin golang (CVE-2017-8932).\n","status":"published","published":"2017-06-29T21:40:57Z","modified":"2026-04-16T06:24:15.31223482Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2017:1649-1","title":"Security update for go","description":"This update for go fixes the following issues:\n\n- CVE-2017-8932: Add patch to fix carry bug in x86-64 P-256 implementation (boo#1040618)\n\nPlease note that go applications will need to be rebuilt to get this fix,\nas all go applications are statically linked.\n\nAs we are regulary releasing updates to our distribution go applications\nthey are not specifically included here.\n","status":"published","published":"2017-06-22T12:29:57Z","modified":"2026-02-04T04:12:18.480452Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2017:1650-1","title":"Security update for go","description":"This update for go fixes the following issues:\n\n- CVE-2017-8932: Add patch to fix carry bug in x86-64 P-256 implementation (boo#1040618)\n\nPlease note that go applications will need to be rebuilt to get this fix,\nas all go applications are statically linked.\n\nAs we are regulary releasing updates to our distribution go applications\nthey are not specifically included here.\n","status":"published","published":"2017-06-22T12:29:57Z","modified":"2026-02-04T03:59:20.248637Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10802-1","title":"go-1.17-1.1 on GA media","description":"These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:22.419368Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10803-1","title":"go1.10-1.10.8-8.2 on GA media","description":"These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:41.250328Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10804-1","title":"go1.11-1.11.13-10.5 on GA media","description":"These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:47.136272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10805-1","title":"go1.12-1.12.17-4.8 on GA media","description":"These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:31.331263Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10812-1","title":"go1.9-1.9.7-11.2 on GA media","description":"These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:45.429147Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-RU-2017:1965-1","title":"Recommended update for Docker, RunC, Containerd","description":"\nThis update for Containerd, Docker and RunC provides several fixes and enhancements.\n\nContainerd:\n\n- Update containerd to the version needed for docker-v17.04.0-ce. (bsc#1034053) \n- Fix spurious messages filling journal. (bsc#1032769)\n- Set TasksMax=infinity to make sure runC doesn't start failing randomly.\n\nDocker:\n\n- Update to version 17.04.0-ce. (bsc#1034053)\n- Fix execids leaks due to bad error handling. (bsc#1037436)\n- Make Apparmor's pkg/aaparser work on read-only root. (bsc#1037607)\n- Improve Docker's systemd configuration. (bsc#1032287)\n- Check if the docker binary is available before attempting to use it. (bsc#1038476)\n- Build man pages for all architectures. (bsc#953182)\n- Fix DNS resolution when Docker host uses 127.0.0.1 as resolver. (bsc#1034063)\n- Enable Delegate=yes, since systemd will safely ignore lvalues it doesn't understand.\n- Update SUSE secrets patch to handle bsc#1030702.\n- Change lvm2 from Requires to Recommends: Docker usually uses a default storage driver,\n  when it's not configured explicitly. This default driver then depends on the underlying\n  system and gets chosen during installation. (bsc#1032644)\n- Disable libseccomp for Leap 42.1, SLE 12 and 12-SP1, because docker needs a higher version.\n  Otherwise, we get the error 'conditional filtering requires libseccomp version \u003e= 2.2.1.\n  (bsc#1028639, bsc#1028638)\n- Add a backport of fix to AppArmor lazy loading docker-exec case.\n- Fix systemd TasksMax default which could throttle docker. (bsc#1026827)\n- Enable pkcs11\n\nFor a comprehensive list of changes please refer to /usr/share/doc/packages/docker/CHANGELOG.md\n\nRunC:\n\n- Update version to the one required by docker-17.04.0-ce. (bsc#1034053) \n- Make sure to ignore cgroup v2 mountpoints. (bsc#1028113)\n","status":"published","published":"2017-07-12T13:49:18Z","modified":"2026-02-04T02:31:18.411222Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}