Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-6A4805D5-5AAF-11EB-A21D-79F5BC5EF6A9 (CVE-2021-3114): go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

FreeBSD: VID-6A4805D5-5AAF-11EB-A21D-79F5BC5EF6A9 (CVE-2021-3114): go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve

Severity
6
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
Published
01/13/2021
Created
01/22/2021
Added
01/20/2021
Modified
03/08/2021

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.

From VID-6A4805D5-5AAF-11EB-A21D-79F5BC5EF6A9:

The Go project reports:

The go command may execute arbitrary code at build time when cgo is

in use on Windows. This may occur when running "go get", or

any other command that builds code. Only users who build untrusted

code (and don't execute it) are affected. In addition to Windows

users, this can also affect Unix users who have "." listed

explicitly in their PATH and are running "go get" or build

commands outside of a module or with module mode disabled.

The P224() Curve implementation can in rare circumstances generate

incorrect outputs, including returning invalid points from

ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not

crypto/tls) packages support P-224 ECDSA keys, but they are not

supported by publicly trusted certificate authorities. No other

standard library or golang.org/x/crypto package supports or uses the

P-224 curve.

Solution(s)

  • freebsd-upgrade-package-go

References

  • CVE-2021-3114

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;