POODLE Attack

crypto/tls in github.com/golang/go is vulnerable to the POODLE attack. The vulnerability exists due to the default SSLv3 fallback configuration in crypto/tls...

So you want to expose Go on the Internet

I was asked to contribute a post to the excellent Gopher Academy advent series. I took the occasion to write down what I learned deploying a Go service on the Cloudflare edge. The result is a catalogue of what you need to know before you drop NGINX from in front of your Go server. The net/http pa...

syncthing: information leakage

This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibly leak their RSA private key due to this issue. Other protocol implementations that create many RSA signatures could also be impacted in the same way. Specifically,...

keybase: information leakage

This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibly leak their RSA private key due to this issue. Other protocol implementations that create many RSA signatures could also be impacted in the same way. Specifically,...

docker: information leakage

This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibly leak their RSA private key due to this issue. Other protocol implementations that create many RSA signatures could also be impacted in the same way. Specifically,...

go -- information disclosure vulnerability

Jason Buberel reports: A security-related issue has been reported in Go's math/big package. The issue was introduced in Go 1.5. We recommend that all users upgrade to Go 1.5.3, which fixes the issue. Go programs must be recompiled with Go 1.5.3 in order to receive the fix. The Go team would like ...

Medium: golang

Issue Overview: crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors. Affected Packages: golang Issue Correction: Run yum update golang or yum update --advisory ALAS-2014-437 to update your system. N...

CVE-2014-7189

CVE-2014-7189 affects the crypto/tls implementation in Go 1.1 up to 1.3.2, where enabling SessionTicketsDisabled can enable MITM attackers to spoof clients via unspecified vectors. Connected records identify this CVE in multiple contexts: GO-2021-0154 describes a MITM attack when SessionTicketsDi...

Exploit for Inadequate Encryption Strength in Openssl

Adam Langley's tool for testing for OpenSSL CVE-2014-0224, origi...