Skip to content
OpenAdvisories
Medium ALAS2-2019-1172 1 CVE

Moderate: golang security update (Amazon Linux 2)

Published Mar 7, 2019 · Updated Mar 8, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-6486: Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks. 1668972: CVE-2019-6486 golang: crypto/elliptic implementations of P-521 and P-384 elliptic curves allow for denial of service

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 golang 0:1.9.4-3.amzn2.0.1
Amazon Linux · 2 golang-bin 0:1.9.4-3.amzn2.0.1
Amazon Linux · 2 golang-docs 0:1.9.4-3.amzn2.0.1
Amazon Linux · 2 golang-misc 0:1.9.4-3.amzn2.0.1
Amazon Linux · 2 golang-src 0:1.9.4-3.amzn2.0.1
Amazon Linux · 2 golang-tests 0:1.9.4-3.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2019-6486

    Denial of service affecting P-521 and P-384 curves in crypto/elliptic

    Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.

    golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-6486.html