CVE - CVE-2019-6486

CVE-ID
CVE-2019-6486	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:106740 URL:http://www.securityfocus.com/bid/106740 CONFIRM:https://github.com/golang/go/commit/42b42f71cf8f5956c09e66230293dfb5db652360 CONFIRM:https://github.com/golang/go/issues/29903 CONFIRM:https://groups.google.com/forum/#!topic/golang-announce/mVeX35iXuSw DEBIAN:DSA-4379 URL:https://www.debian.org/security/2019/dsa-4379 DEBIAN:DSA-4380 URL:https://www.debian.org/security/2019/dsa-4380 MISC:https://github.com/google/wycheproof MLIST:[debian-lts-announce] 20190206 [SECURITY] [DLA 1664-1] golang security update URL:https://lists.debian.org/debian-lts-announce/2019/02/msg00009.html SUSE:openSUSE-SU-2019:1164 URL:http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00042.html SUSE:openSUSE-SU-2019:1444 URL:http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html SUSE:openSUSE-SU-2019:1499 URL:http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html SUSE:openSUSE-SU-2019:1506 URL:http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
Assigning CNA
MITRE Corporation
Date Record Created
20190118	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20190118)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)