golang: crypto/elliptic: panic caused by oversized scalar

🗓️ 10 Jul 2023 09:56:57Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

Oversized scalar in Go crypto/elliptic can panic P256 ScalarMult or ScalarBaseMult, risking availability.

Reporter	Title	Published	Views	Family All 1656
Oracle linux	go-toolset:ol8addon security update	8 Jun 202200:00	–	oraclelinux
Oracle linux	go-toolset:ol8addon security update	12 Jul 202200:00	–	oraclelinux
Oracle linux	go-toolset:ol8 security and bug fix update	1 Jul 202200:00	–	oraclelinux
OpenVAS	Fedora: Security Advisory for golang-github-geertjohan-rice (FEDORA-2022-fae3ecee19)	6 Jul 202200:00	–	openvas
OpenVAS	Fedora: Security Advisory for golang-github-nats-io-nkeys (FEDORA-2022-fae3ecee19)	6 Jul 202200:00	–	openvas
OpenVAS	Fedora: Security Advisory for htmltest (FEDORA-2022-fae3ecee19)	6 Jul 202200:00	–	openvas
OpenVAS	Fedora: Security Advisory for golang-github-u-root-iscsinl (FEDORA-2022-fae3ecee19)	6 Jul 202200:00	–	openvas
OpenVAS	Fedora: Security Advisory for golang-github-mattn-colorable (FEDORA-2022-fae3ecee19)	6 Jul 202200:00	–	openvas
OpenVAS	Fedora: Security Advisory for golang-github-vmware-govmomi (FEDORA-2022-fae3ecee19)	6 Jul 202200:00	–	openvas
OpenVAS	Fedora: Security Advisory for golang-github-google-jsonnet (FEDORA-2022-fae3ecee19)	6 Jul 202200:00	–	openvas

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	x86_64	skupper-cli	1.4.1-2.el8	skupper-cli-1.4.1-2.el8.x86_64.rpm
Red Hat Enterprise Linux	9	x86_64	skupper-cli	1.4.1-2.el9	skupper-cli-1.4.1-2.el9.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-28327
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
groups	www.groups.google.com/g/golang-announce/c/oecdBNLOml8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-28327
cve	www.cve.org/CVERecord

28 Jul 2026 04:30Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 3.17.5

EPSS0.04195

elliptic golang crypto panic oversized scalar scalar multiplication p256 curve availability