Description
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u1 | DSA-4379-1 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u1 | DSA-4380-1 |
| Debian 8 | golang | 2:1.3.3-1+deb8u1 | DLA-1664-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | containerd | 1.2.5-5.13.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | docker | 18.09.6_ce-6.17.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-4.12.1 | SUSE-SU-2019:1234-2 |
| SLES 15 | containerd | 1.2.5-5.13.1 | SUSE-SU-2019:1234-1 |
| SLES 15 | docker | 18.09.6_ce-6.17.1 | SUSE-SU-2019:1234-1 |
| SLES 15 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1 | SUSE-SU-2019:1234-1 |
| SLES 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-4.12.1 | SUSE-SU-2019:1234-1 |
| SLES 12 | containerd | 1.2.5-16.17.2 | SUSE-SU-2019:1264-1 |
| SLES 12 | docker | 18.09.6_ce-98.37.1 | SUSE-SU-2019:1264-1 |
| SLES 12 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-1.23.1 | SUSE-SU-2019:1264-1 |
| SLES 12 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-19.1 | SUSE-SU-2019:1264-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 | go | 1.12-bp150.2.6.1 | openSUSE-SU-2019:1506-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go | 1.17-1.1 | openSUSE-SU-2024:10802-1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 | openSUSE-SU-2024:10803-1 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 | openSUSE-SU-2024:10804-1 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 | openSUSE-SU-2024:10805-1 |
| openSUSE Leap 15.1 | containerd | 1.2.5-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | docker | 18.09.6_ce-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go | 1.12-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go1.11 | 1.11.9-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go1.12 | 1.12.4-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.0 | containerd | 1.2.5-lp150.4.14.3 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | docker | 18.09.6_ce-lp150.5.17.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go | 1.12-lp150.2.11.1 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go1.11 | 1.11.5-lp150.6.4 | openSUSE-SU-2019:1499-1, openSUSE-SU-2019:1164-1 |
| openSUSE Leap 15.0 | go1.12 | 1.12.4-lp150.2.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1 | openSUSE-SU-2019:1499-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.11.5-r0 | — |
| Alpine v3.23 | go | 1.11.5-r0 | — |
| Alpine v3.22 | go | 1.11.5-r0 | — |
| Alpine v3.21 | go | 1.11.5-r0 | — |
| Alpine v3.20 | go | 1.11.5-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.11.5-r0 | — |
| Alpine v3.18 | go | 1.11.5-r0 | — |
| Alpine v3.17 | go | 1.11.5-r0 | — |
| Alpine v3.16 | go | 1.11.5-r0 | — |
| Alpine v3.15 | go | 1.11.5-r0 | — |
| Alpine v3.14 | go | 1.11.5-r0 | — |
| Alpine v3.13 | go | 1.11.5-r0 | — |
| Alpine v3.12 | go | 1.11.5-r0 | — |
| Alpine v3.11 | go | 1.11.5-r0 | — |
| Alpine v3.10 | go | 1.11.5-r0 | — |
| Alpine v3.9 | go | 1.11.5-r0 | — |
| Alpine v3.8 | go | 1.10.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | golang +5 | 1.9.4-3.amzn2.0.1 | ALAS2-2019-1172 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | docker-engine | 17.06.2.ol-1.0.6.el7 | ELSA-2019-4551, ELSA-2019-4550 |
| Oracle Linux 7 | kubeadm +2 | 1.9.11-2.2.1.el7 | ELSA-2019-4546 |
| Oracle Linux 7 | kubernetes-cni +1 | 0.6.0-2.1.1.el7 | ELSA-2019-4546 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.10.8 · >= 1.11.0-0, < 1.11.5 | 1.10.8, 1.11.5 | GO-2022-0217 |
Advisories 18
- DSA-4379-1 golang-1.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4380-1 golang-1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1664-1 golang - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:1234-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1164-1 Security update for go1.11 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10803-1 go1.10-1.10.8-8.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1444-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1499-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1264-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10804-1 go1.11-1.11.13-10.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1234-2 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1506-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10805-1 go1.12-1.12.17-4.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10802-1 go-1.17-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2-2019-1172 Moderate: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 8, 2019
- ELSA-2019-4551 Important: docker-engine security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 19, 2019
- ELSA-2019-4550 Important: docker-engine security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 15, 2019
- ELSA-2019-4546 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 14, 2019
References
- https://github.com/golang/go/issues/29903
- DSA-4380 vendor-advisory
- https://groups.google.com/forum/#%21topic/golang-announce/mVeX35iXuSw
- DSA-4379 vendor-advisory
- https://github.com/golang/go/commit/42b42f71cf8f5956c09e66230293dfb5db652360
- [debian-lts-announce] 20190206 [SECURITY] [DLA 1664-1] golang security update mailing-list
- 106740 vdb-entry
- https://github.com/google/wycheproof
- openSUSE-SU-2019:1164 vendor-advisory
- openSUSE-SU-2019:1444 vendor-advisory
- openSUSE-SU-2019:1499 vendor-advisory
- openSUSE-SU-2019:1506 vendor-advisory