Skip to content

crypto/ecdsa: P521 ecdsa.Verify panics with malformed message [1.21 backport] #60745

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
gopherbot opened this issue Jun 12, 2023 · 1 comment
Closed

crypto/ecdsa: P521 ecdsa.Verify panics with malformed message [1.21 backport] #60745

gopherbot opened this issue Jun 12, 2023 · 1 comment
Labels
CherryPickCandidate Used during the release process for point releases FrozenDueToAge

Comments

@gopherbot
Copy link
Contributor

@FiloSottile requested issue #60741 to be considered for backport to the next 1.21 minor release.

@gopherbot please open a Go 1.20 backport.

I think this doesn't have security impact because ECDSA hashes are not attacker-controlled and no one has a 528 hash laying around, but it's a spec deviation leading to a panic, so might as well fix it in Go 1.21 and backport it.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Jun 12, 2023
@gopherbot gopherbot mentioned this issue Jun 12, 2023
Closed
@FiloSottile
Copy link
Contributor

We are still in time to fix this for Go 1.21, @gopherbot just misread "Go 1.21" in the second paragraph.

@dmitshur dmitshur closed this as not planned Won't fix, can't repro, duplicate, stale Jun 14, 2023
@golang golang locked and limited conversation to collaborators Jun 13, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickCandidate Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@FiloSottile @dmitshur @gopherbot