4 ms·

Looking at the issue tracker ( https://github.com/golang/go/issues?q=is%3Aopen+is%3Aissue+milestone%3AGo1.6.1 https://github.com/golang/go/issues?q=is%3Aopen+is

by codys 10y ago

Looking at the issue tracker ( https://github.com/golang/go/issues?q=is%3Aopen+is%3Aissue+milestone%3AGo1.6.1 https://github.com/golang/go/issues?q=is%3Aopen+is%3Aissue+m... ) looks like a windows DLL preload attack & another unspecified bug (currently a placeholder). If we take a look at the release branch though, it appears it might be crypto related: https://github.com/golang/go/commits/release-branch.go1.6 https://github.com/golang/go/commits/release-branch.go1.6 https://github.com/golang/go/commit/4afe4c803ec378d7a0d7fbc38d961df541d72134 https://github.com/golang/go/commit/4afe4c803ec378d7a0d7fbc3... https://github.com/golang/go/commit/2d8ecac3d0dbceed8830a43a3e752770577ffed1 https://github.com/golang/go/commit/2d8ecac3d0dbceed8830a43a...

tptacek 10y ago
Never say never, but I'm not super concerned about those crypto changes. RSA decrypt in Go is only used for actual decrypt, so parameter checking of the RSA privkey seems benign. And you don't usually have an attacker who can choose the modulus in your curve algorithm.
- tyho 10y ago
  """ Go has an infinite loop in several big integer routines that makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client authentication or the Go ssh server libraries are both exposed to this vulnerability. This is being addressed in the following CL: https://golang.org/cl/21533 https://golang.org/cl/21533 """ http://seclists.org/oss-sec/2016/q2/11 http://seclists.org/oss-sec/2016/q2/11
  - tptacek 10y ago
    Ahhhhh, I didn't consider DOS.
kyrra 10y ago
And someone actually picked up on the Golang team asking for CVE numbers a couple days ago: https://www.reddit.com/r/golang/comments/4diazi/osssec_cve_request_go/ https://www.reddit.com/r/golang/comments/4diazi/osssec_cve_r... Changes: https://golang.org/cl/21533 https://golang.org/cl/21533 and https://golang.org/cl/21428 https://golang.org/cl/21428

by codys 10y ago

tptacek 10y ago

Never say never, but I'm not super concerned about those crypto changes. RSA decrypt in Go is only used for actual decrypt, so parameter checking of the RSA privkey seems benign. And you don't usually have an attacker who can choose the modulus in your curve algorithm.

tyho 10y ago
""" Go has an infinite loop in several big integer routines that makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client authentication or the Go ssh server libraries are both exposed to this vulnerability. This is being addressed in the following CL: https://golang.org/cl/21533 https://golang.org/cl/21533 """ http://seclists.org/oss-sec/2016/q2/11 http://seclists.org/oss-sec/2016/q2/11
- tptacek 10y ago
  Ahhhhh, I didn't consider DOS.

kyrra 10y ago

And someone actually picked up on the Golang team asking for CVE numbers a couple days ago: https://www.reddit.com/r/golang/comments/4diazi/osssec_cve_request_go/ https://www.reddit.com/r/golang/comments/4diazi/osssec_cve_r... Changes: https://golang.org/cl/21533 https://golang.org/cl/21533 and https://golang.org/cl/21428 https://golang.org/cl/21428