diff options
| author | Minjae Kim <flowergom@gmail.com> | 2022-02-26 20:55:34 +0000 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-03-09 17:30:48 +0000 |
| commit | dfd900b5b0a8834499cddbfcb196ecccd79c9003 (patch) | |
| tree | b5d01009d0e4b0a3a5da3fea950bf6bbe04619ff /meta/recipes-devtools/go/go-1.14.inc | |
| parent | 6bba192936c25702316589ca59403daa1bf574da (diff) | |
| download | poky-dfd900b5b0a8834499cddbfcb196ecccd79c9003.tar.gz | |
go: fix CVE-2022-23806
crypto/elliptic: fix IsOnCurve for big.Int values that are not valid coordinates
Some big.Int values that are not valid field elements (negative or overflowing)
might cause Curve.IsOnCurve to incorrectly return true. Operating on those values
may cause a panic or an invalid curve operation. Note that Unmarshal will never
return such values.
Upstream-Status: Backport [https://go.dev/issue/50974]
CVE: CVE-2022-23806
(From OE-Core rev: eb7aa0929ecd712aeeec0ff37dfb77c3da33b375)
Signed-off-by:Minjae Kim <flowergom@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/go/go-1.14.inc')
| -rw-r--r-- | meta/recipes-devtools/go/go-1.14.inc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc index abc6f42184..fcb316e09e 100644 --- a/meta/recipes-devtools/go/go-1.14.inc +++ b/meta/recipes-devtools/go/go-1.14.inc | |||
| @@ -19,6 +19,7 @@ SRC_URI += "\ | |||
| 19 | file://CVE-2021-34558.patch \ | 19 | file://CVE-2021-34558.patch \ |
| 20 | file://CVE-2021-33196.patch \ | 20 | file://CVE-2021-33196.patch \ |
| 21 | file://CVE-2021-33197.patch \ | 21 | file://CVE-2021-33197.patch \ |
| 22 | file://CVE-2022-23806.patch \ | ||
| 22 | " | 23 | " |
| 23 | SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" | 24 | SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" |
| 24 | SRC_URI[main.sha256sum] = "7ed13b2209e54a451835997f78035530b331c5b6943cdcd68a3d815fdc009149" | 25 | SRC_URI[main.sha256sum] = "7ed13b2209e54a451835997f78035530b331c5b6943cdcd68a3d815fdc009149" |