NVD Vulnerability Detail

CVE-2015-8618

Summary	The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors.
Publication Date	Jan. 28, 2016, 5:59 a.m.
Registration Date	Jan. 26, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 11:38 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175642.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175642.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176179.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176179.html
5	http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html
6	http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html
7	http://www.openwall.com/lists/oss-security/2015/12/21/6
8	http://www.openwall.com/lists/oss-security/2015/12/21/6
9	http://www.openwall.com/lists/oss-security/2015/12/22/9
10	http://www.openwall.com/lists/oss-security/2015/12/22/9
11	http://www.openwall.com/lists/oss-security/2016/01/13/7
12	http://www.openwall.com/lists/oss-security/2016/01/13/7
13	https://github.com/golang/go/issues/13515	Patch
14	https://github.com/golang/go/issues/13515	Patch
15	https://go-review.googlesource.com/#/c/17672/
16	https://go-review.googlesource.com/#/c/17672/
17	https://groups.google.com/forum/#%21topic/golang-announce/MEATuOi_ei4
18	https://groups.google.com/forum/#%21topic/golang-announce/MEATuOi_ei4

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Go の math/big ライブラリ内の Int.Exp Montgomery コードにおける RSA 秘密鍵を取得される脆弱性

Title	Go の math/big ライブラリ内の Int.Exp Montgomery コードにおける RSA 秘密鍵を取得される脆弱性
Summary	Go の math/big ライブラリ内の Int.Exp Montgomery コードは、キャリープロパゲーションを誤って処理し、不正な出力を生成するため、RSA 秘密鍵を取得される脆弱性が存在します。
Possible impacts	攻撃者により、RSA 秘密鍵を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 7, 2015, midnight
Registration Date	Feb. 25, 2016, 11:22 a.m.
Last Update	Feb. 25, 2016, 11:22 a.m.

Affected System

The Go Project

Go 1.5.3 未満の 1.5.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-8618	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8618
2	CVE-2015-8618	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8618
National Vulnerability Database (NVD)
3	CVE-2015-8618	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8618
4	CVE-2015-8618	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8618

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html
2	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
GitHub
1	math/big: incorrect result from Exp on 386 architecture #13515	https://github.com/golang/go/issues/13515
2	math/big: incorrect result from Exp on 386 architecture #13515	https://github.com/golang/go/issues/13515
Google Developers
3	Change 17672 - Merged	https://go-review.googlesource.com/#/c/17672/
4	Change 17672 - Merged	https://go-review.googlesource.com/#/c/17672/
Google Groups
5	[security] Go 1.5.3 is released	https://groups.google.com/forum/#!topic/golang-announce/MEATuOi_ei4
6	[security] Go 1.5.3 is released	https://groups.google.com/forum/#!topic/golang-announce/MEATuOi_ei4
The Go Project
7	Downloads	https://golang.org/dl/
8	Downloads	https://golang.org/dl/

Change Log

No	Changed Details	Date of change
0	[2016年02月25日] 掲載	Feb. 17, 2018, 10:37 a.m.
0	[2016年02月25日] 掲載	Feb. 17, 2018, 10:37 a.m.