CVE-2015-8618

The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2016-01-27

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Go (Golang)
• Leap (Opensuse)

References

• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175642.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176179.html
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html
• http://www.openwall.com/lists/oss-security/2015/12/21/6
• http://www.openwall.com/lists/oss-security/2015/12/22/9
• http://www.openwall.com/lists/oss-security/2016/01/13/7
• https://github.com/golang/go/issues/13515
• https://go-review.googlesource.com/#/c/17672/
• https://groups.google.com/forum/#%21topic/golang-announce/MEATuOi_ei4