Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/ecdh: ECDH method doesn't check curve [1.20 backport] #58498

Closed
gopherbot opened this issue Feb 13, 2023 · 2 comments
Closed

crypto/ecdh: ECDH method doesn't check curve [1.20 backport] #58498

gopherbot opened this issue Feb 13, 2023 · 2 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Milestone
Go1.20.2

Comments

@gopherbot
Copy link
Contributor

@FiloSottile requested issue #58131 to be considered for backport to the next 1.20 minor release.

@gopherbot please backport to Go 1.20. This is a crasher in Go+BoringCrypto that we don't consider a security vulnerability (since Go+BoringCrypto is unsupported) but would be better not to leave laying around, and the patch is tiny and safe.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Feb 13, 2023
@gopherbot gopherbot mentioned this issue Feb 13, 2023
Closed
@gopherbot gopherbot modified the milestones: Go1.20.1, Go1.20.2 Feb 13, 2023
@prattmic prattmic added the CherryPickApproved Used during the release process for point releases label Feb 15, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Feb 15, 2023
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/471602 mentions this issue: [release-branch.go1.20] crypto/ecdh: explicitly reject mismatched curves in ECDH

@gopherbot
Copy link
Contributor Author

Closed by merging aaace6d to release-branch.go1.20.

gopherbot pushed a commit that referenced this issue Feb 28, 2023
@rolandshoemaker @gopherbot
[release-branch.go1.20] crypto/ecdh: explicitly reject mismatched cur…
aaace6d 
…ves in ECDH

Return an explicit error when PrivateKey.ECDH is called with a PublicKey
which uses a different Curve. Also document this requirement, even
though it is perhaps obvious.

Updates #58131.
Fixes #58498.

Change-Id: I739181a3f1283bed14fb5ee7eb78658b854d28d8
Reviewed-on: https://go-review.googlesource.com/c/go/+/464335
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
(cherry picked from commit 67d8916)
Reviewed-on: https://go-review.googlesource.com/c/go/+/471602
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
romaindoumenc pushed a commit to TroutSoftware/go that referenced this issue Mar 3, 2023
@rolandshoemaker @romaindoumenc
[release-branch.go1.20] crypto/ecdh: explicitly reject mismatched cur…
73ea0fd 
…ves in ECDH

Return an explicit error when PrivateKey.ECDH is called with a PublicKey
which uses a different Curve. Also document this requirement, even
though it is perhaps obvious.

Updates golang#58131.
Fixes golang#58498.

Change-Id: I739181a3f1283bed14fb5ee7eb78658b854d28d8
Reviewed-on: https://go-review.googlesource.com/c/go/+/464335
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
(cherry picked from commit 67d8916)
Reviewed-on: https://go-review.googlesource.com/c/go/+/471602
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
@golang golang locked and limited conversation to collaborators Feb 28, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
Go1.20.2
Development

No branches or pull requests
2 participants
@prattmic @gopherbot