FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve

Affected packages
go < 1.15.7,1

Details

VuXML ID 6a4805d5-5aaf-11eb-a21d-79f5bc5ef6a9
Discovery 2021-01-13
Entry 2021-01-19

The Go project reports:

The go command may execute arbitrary code at build time when cgo is in use on Windows. This may occur when running "go get", or any other command that builds code. Only users who build untrusted code (and don't execute it) are affected. In addition to Windows users, this can also affect Unix users who have "." listed explicitly in their PATH and are running "go get" or build commands outside of a module or with module mode disabled.

The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages support P-224 ECDSA keys, but they are not supported by publicly trusted certificate authorities. No other standard library or golang.org/x/crypto package supports or uses the P-224 curve.

References

CVE Name CVE-2021-3114
CVE Name CVE-2021-3115
URL http://golang.org/issue/43783
URL http://golang.org/issue/43786