{"id":"CVE-2019-6486","aliases":["ALPINE-CVE-2019-6486","AZL-79018","AZL-98958","BELL-CVE-2019-6486","DEBIAN-CVE-2019-6486","DLA-1664-1","DSA-4379-1","DSA-4380-1","EUVD-2019-16046","GHSA-vj2x-6gjj-jvh2","GO-2022-0217","MGASA-2019-0066","SUSE-SU-2019:0651-1","SUSE-SU-2019:1149-1","SUSE-SU-2019:1234-1","SUSE-SU-2019:1234-2","SUSE-SU-2019:1264-1","UBUNTU-CVE-2019-6486","openSUSE-SU-2019:1164-1","openSUSE-SU-2019:1444-1","openSUSE-SU-2019:1499-1","openSUSE-SU-2019:1506-1","openSUSE-SU-2024:10802-1","openSUSE-SU-2024:10803-1","openSUSE-SU-2024:10804-1","openSUSE-SU-2024:10805-1"],"status":"published","title":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which...","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","severity":{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04501,"percentile":0.91564,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2019-01-24T05:00:00Z","modified":"2026-11-03T06:32:18Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"go","fixed_in":["1.10.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"go","fixed_in":["1.11.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"golang","fixed_in":["2:1.3.3-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.10.8","1.11.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"go1.11","fixed_in":["1.11.5-lp150.6.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.10.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.3.3-1+deb8u1"}]}],"versions":["2:1.3.3-1"]},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2+deb9u1"}]}],"versions":["1.7.4-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1+deb9u1"}]}],"versions":["1.8.1-1"],"bundled":3},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.8"},{"introduced":"1.11.0-0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-5.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-6.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-4.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-5.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-6.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-4.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-16.17.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-98.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-1.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5-lp150.6.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.9-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.4-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-lp150.4.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-lp150.5.17.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-lp150.2.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.9-lp150.9.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.4-lp150.2.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-bp150.2.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-10.5"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.17-4.8"}]}],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"golang","product":"go"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://github.com/golang/go/issues/29903","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4380","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://groups.google.com/forum/#%21topic/golang-announce/mVeX35iXuSw","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4379","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/golang/go/commit/42b42f71cf8f5956c09e66230293dfb5db652360","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/106740","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/google/wycheproof","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6486","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/mVeX35iXuSw"},{"url":"https://github.com/advisories/GHSA-vj2x-6gjj-jvh2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-6486","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-6486","tags":["advisory"]},{"url":"https://go.dev/cl/159218","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/193c16a3648b8670a762e925b6ac6e074f468a20","tags":["fix"]},{"url":"https://go.dev/issue/29903","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/mVeX35iXuSw","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0066.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24014","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-12/msg00094.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190651-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123013","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121397","tags":["report"]},{"url":"https://bugzilla.suse.com/1125768","tags":["report"]},{"url":"https://bugzilla.suse.com/974800","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191234-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1114209","tags":["report"]},{"url":"https://bugzilla.suse.com/1114832","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1121967","tags":["report"]},{"url":"https://bugzilla.suse.com/1128376","tags":["report"]},{"url":"https://bugzilla.suse.com/1128746","tags":["report"]},{"url":"https://bugzilla.suse.com/1134068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5736","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191234-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191264-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-6486","tags":["report"]},{"url":"https://groups.google.com/forum/m/#!topic/golang-announce/mVeX35iXuSw","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6486","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FZRBOBPHDDUGPVRJCXTMV4QPQ6VDZSMV/#FZRBOBPHDDUGPVRJCXTMV4QPQ6VDZSMV","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CER2ESZ3IMKBBAWOVTY65MHSHQAI2UVB/#CER2ESZ3IMKBBAWOVTY65MHSHQAI2UVB","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IF5UCHNMLYYGABZ53J2EKXLMRHH3UVO3/#IF5UCHNMLYYGABZ53J2EKXLMRHH3UVO3","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HM6FFITESF23XEYSCI7KTKZVCPQU2CMO/#HM6FFITESF23XEYSCI7KTKZVCPQU2CMO","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-6486","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:00:00Z","modified":"2024-08-04T20:23:20.998Z","updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-16046","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:00:00Z","modified":"2024-08-04T20:23:20Z","updated_at":"2026-11-03T03:06:49.204502Z"}],"ghsa":[{"id":"GHSA-vj2x-6gjj-jvh2","title":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which...","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2022-05-13T01:22:42Z","modified":"2023-02-01T05:06:49Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:50:25.548742Z"}],"nvd":[{"id":"CVE-2019-6486","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:29:00.907Z","modified":"2026-06-17T02:39:07.417Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-6486","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:29:00.907Z","modified":"2026-11-03T06:32:18.712134227Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"AZL-79018","title":"CVE-2019-6486 affecting package golang 1.25.7-1","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:29:00Z","modified":"2026-04-21T04:34:35.704142Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98958","title":"CVE-2019-6486 affecting package golang 1.27.1-1","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:29:00Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2019-6486","title":"CVE-2019-6486 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:32.512279Z","modified":"2026-01-26T09:47:30.817216Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-6486","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:29:00.907Z","modified":"2026-10-20T10:52:45.024981618Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"UBUNTU-CVE-2019-6486","description":"Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.","status":"published","published":"2019-01-24T05:29:00Z","modified":"2025-10-24T04:47:29Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DLA-1664-1","title":"golang - security update","status":"published","published":"2019-02-06T00:00:00Z","modified":"2026-03-09T01:20:37.827167Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4379-1","title":"golang-1.7 - security update","status":"published","published":"2019-02-01T00:00:00Z","modified":"2026-03-09T02:10:56.796999Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4380-1","title":"golang-1.8 - security update","status":"published","published":"2019-02-01T00:00:00Z","modified":"2026-03-09T02:09:57.151142Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"GO-2022-0217","title":"Denial of service affecting P-521 and P-384 curves in crypto/elliptic","description":"A DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU.\n\nThese inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some cases, if an ECDH private key is reused more than once, the attack can also lead to key recovery.","status":"published","published":"2022-05-24T15:21:01Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2019-0066","title":"Updated golang packages fix security vulnerability","description":"Remote code execution in go get, when executed with the -u flag\n(CVE-2018-16873).\n\nAn arbitrary filesystem write in go get, which could lead to code execution\n(CVE-2018-16874).\n\nDenial of Service in the crypto/x509 package during certificate chain\nvalidation (CVE-2018-16875).\n\nGo before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows\nattackers to cause a denial of service (CPU consumption) or possibly conduct\nECDH private key recovery attacks (CVE-2019-6486).\n","status":"published","published":"2019-02-13T11:08:25Z","modified":"2026-04-16T04:44:46.119665677Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1164-1","title":"Security update for go1.11","description":"This update for go1.11 to version 1.11.5 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-6486: Fixed a CPU Denial-of-Service vulnerability affecting\n  crypto/ellpitic related to P-521 and P-384  (bsc#1123013 go#29903).\n\nOther bug fixes and changes made:\n\n- Fix erroneous trailing backslash in %post script.\n- Use better forms of -exec \\; in some places.\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-05T10:09:55Z","modified":"2026-02-04T04:29:43.664078Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1444-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-27T05:09:20Z","modified":"2026-02-04T04:13:40.567028Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1499-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-06-03T08:21:16Z","modified":"2026-02-04T04:10:51.06425Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1506-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n\nThis update was imported from the SUSE:SLE-15:Update update project.\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-06-03T11:22:06Z","modified":"2026-02-04T02:41:42.913839Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10802-1","title":"go-1.17-1.1 on GA media","description":"These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:22.419368Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10803-1","title":"go1.10-1.10.8-8.2 on GA media","description":"These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:41.250328Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10804-1","title":"go1.11-1.11.13-10.5 on GA media","description":"These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:47.136272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10805-1","title":"go1.12-1.12.17-4.8 on GA media","description":"These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:31.331263Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:0651-1","title":"Security update for go1.11","description":"This update for go1.11 to version 1.11.5 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-6486: Fixed a CPU Denial-of-Service vulnerability affecting\n  crypto/ellpitic related to P-521 and P-384  (bsc#1123013 go#29903).\n\nOther bug fixes and changes made:\n\n- Fix erroneous trailing backslash in %post script.\n- Use better forms of -exec \\; in some places.\n","status":"published","published":"2019-03-19T14:34:38Z","modified":"2026-02-04T02:39:52.539033Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1149-1","title":"Security update for go1.10","description":"This update for go1.10 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6486: A CPU denial of service vulnerability affecting P-521 and P-384 elliptic curves was fixed.\n\nOther fixes:\n\n- go1.10.8 (released 2019/01/23) security release fixes CVE-2019-6486.\n- Enable build for %arm (bsc#1125768), with go1.4 as building \n  with gccgo hangs (bsc#974800)\n","status":"published","published":"2019-05-03T16:05:15Z","modified":"2026-02-04T03:49:53.682393Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1234-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n","status":"published","published":"2019-05-14T16:31:56Z","modified":"2026-02-04T04:31:28.603199Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1234-2","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n","status":"published","published":"2019-06-13T13:28:57Z","modified":"2026-02-04T03:05:38.061456Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1264-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go security release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, boo#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, boo#1134068).\n- Update to Docker 18.09.6-ce see upstream changelog in the packaged\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Update to go1.11.9 (released 2019/04/11)\n- Fix go build failures (bsc#1121397).\n- Update to golang-github-docker-libnetwork version git.872f0a83c98add6cae255c8859e29532febc0039 which is required for Docker v18.09.6-ce.\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n","status":"published","published":"2019-05-16T07:50:31Z","modified":"2026-02-04T03:41:36.790383Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}