The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 8, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golang-miscUpgrade golang-testsUpgrade golangUpgrade golang-binUpgrade containerdUpgrade containerd-stressUpgrade golang-docsUpgrade containerd-debuginfoUpgrade golang-raceUpgrade golang-shared | Apr 21, 2023 | Mar 8, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Mar 8, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golangUpgrade golang-raceUpgrade golang-miscUpgrade golang-binUpgrade golang-docsUpgrade golang-srcUpgrade golang-tests | Feb 17, 2025 | Mar 8, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Mar 8, 2023 |
| Freebsd | — | Upgrade go119Upgrade go120 | Mar 9, 2023 | Mar 8, 2023 |
| Redhat_linux | — | Upgrade golang-raceUpgrade delve-debugsourceUpgrade delve-debuginfoUpgrade golang-testsUpgrade golang-binUpgrade delveUpgrade golang-docsUpgrade golangUpgrade go-toolsetUpgrade golang-miscUpgrade golang-src | Sep 3, 2024 | Mar 8, 2023 |
| Suse | — | Upgrade go1.20-docUpgrade go1.19Upgrade container-suseconnectUpgrade go1.20Upgrade go1.19-docUpgrade go1.19-raceUpgrade go1.20-race | Mar 15, 2023 | Mar 8, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 8, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub