AmazonALAS-2017-857Medium: golang
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
0.005 Low
EPSS
Percentile
75.3%
Issue Overview:
Golang: Elliptic curves carry propagation issue in x86-64 P-256. A carry propagation flaw was found in the implementation of the P-256 elliptic curve in golang. An attacker could use this flaw to extract private keys when static ECDH is used. (CVE-2017-8932)
Affected Packages:
golang
Issue Correction:
Run yum update golang to update your system.
New Packages:
i686:
golang-1.7.5-2.39.amzn1.i686
golang-bin-1.7.5-2.39.amzn1.i686
noarch:
golang-tests-1.7.5-2.39.amzn1.noarch
golang-src-1.7.5-2.39.amzn1.noarch
golang-misc-1.7.5-2.39.amzn1.noarch
golang-docs-1.7.5-2.39.amzn1.noarch
src:
golang-1.7.5-2.39.amzn1.src
x86_64:
golang-bin-1.7.5-2.39.amzn1.x86_64
golang-1.7.5-2.39.amzn1.x86_64
Additional References
Red Hat: CVE-2017-8932
Mitre: CVE-2017-8932
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | golang | < 1.7.5-2.39.amzn1 | golang-1.7.5-2.39.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | golang-bin | < 1.7.5-2.39.amzn1 | golang-bin-1.7.5-2.39.amzn1.i686.rpm |
| Amazon Linux | 1 | noarch | golang-tests | < 1.7.5-2.39.amzn1 | golang-tests-1.7.5-2.39.amzn1.noarch.rpm |
| Amazon Linux | 1 | noarch | golang-src | < 1.7.5-2.39.amzn1 | golang-src-1.7.5-2.39.amzn1.noarch.rpm |
| Amazon Linux | 1 | noarch | golang-misc | < 1.7.5-2.39.amzn1 | golang-misc-1.7.5-2.39.amzn1.noarch.rpm |
| Amazon Linux | 1 | noarch | golang-docs | < 1.7.5-2.39.amzn1 | golang-docs-1.7.5-2.39.amzn1.noarch.rpm |
| Amazon Linux | 1 | x86_64 | golang-bin | < 1.7.5-2.39.amzn1 | golang-bin-1.7.5-2.39.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | golang | < 1.7.5-2.39.amzn1 | golang-1.7.5-2.39.amzn1.x86_64.rpm |
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
0.005 Low
EPSS
Percentile
75.3%