HIGH7.5
GO-2022-0435
Panic due to large inputs affecting P-256 curves in crypto/elliptic
Quick fix
GO-2022-0435 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.17.9Details
A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.
Are you affected?
Enter the version of the package you're using.