CVE-2021-3114: Vulnerability in golang package - Incorrect Outputs in crypto/elliptic/p224.go
Summary
CVE-2021-3114: In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. Affects golang across 2 version ranges.
< 1.14.14
>= 1.15.0, < 1.15.7
Fixed in 1.14.14 or 1.15.7, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
- golang-1.15 · Debian:11
The same CVE-2021-3114 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that is widely used for developing efficient and reliable software applications. It provides a rich set of libraries and tools for various purposes, including cryptography. One of the cryptographic components in the golang package is the elliptic curve implementation, which includes the p224.go file. This file is responsible for generating outputs in the P-224 field. However, versions of Go before 1.14.14 and 1.15.x before 1.15.7 suffer from a vulnerability in the p224.go file, leading to the generation of incorrect outputs. This vulnerability is caused by an underflow of the lowest limb during the final complete reduction in the P-224 field.
Vulnerability Detail
The vulnerability in the p224.go file of the golang package can have significant security implications. When incorrect outputs are generated, it can lead to cryptographic weaknesses and potential exploitation by attackers. The underflow of the lowest limb during the final complete reduction in the P-224 field can result in incorrect calculations and compromise the integrity and confidentiality of cryptographic operations relying on this functionality. It is crucial to address this vulnerability promptly to ensure the security of systems using the affected versions of the golang package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.14.141.14.14 -
>= 1.15.0, < 1.15.71.15.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the golang package to the fixed versions as mentioned above.
Conclusion
The vulnerability in the golang package's p224.go file can result in the generation of incorrect outputs in the P-224 field, compromising the security of cryptographic operations. To mitigate this vulnerability, it is crucial to update the golang package to version 1.14.14 or later for Go 1.14.x, and version 1.15.7 or later for Go 1.15.x. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can lead to incorrect outputs in the P-224 field, compromising the integrity and confidentiality of cryptographic operations relying on this functionality.
Versions of Go before 1.14.14 and 1.15.x before 1.15.7 are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is crucial to address it promptly to prevent potential exploitation.
Yes, the fix for this vulnerability is available in golang package versions 1.14.14 and 1.15.7 or later.
If you are using an affected version of the golang package, it is recommended to update to the fixed versions (1.14.14 or 1.15.7) as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for golang.
