CRITICAL9.1

GO-2021-0319

Incorrect computation for some invalid field elements in crypto/elliptic

Quick fix

GO-2021-0319 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.16.14

Details

Some big.Int values that are not valid field elements (negative or overflowing) might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.16.14

Fixgo get stdlib@v1.16.14

References

https://go.dev/cl/382455[FIX]
https://go.googlesource.com/go/+/7f9494c277a471f6f47f4af3036285c0b1419816[FIX]
https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ[WEB]
https://go.dev/issue/50974[REPORT]