|author||Filippo Valsorda <firstname.lastname@example.org>||Fri Jan 24 18:04:20 2020 -0500|
|committer||Filippo Valsorda <email@example.com>||Fri Jan 24 23:41:10 2020 +0000|
[release-branch.go1.13-security] src/go.mod: import x/crypto/cryptobyte security fix for 32-bit archs cryptobyte: fix panic due to malformed ASN.1 inputs on 32-bit archs When int is 32 bits wide (on 32-bit architectures like 386 and arm), an overflow could occur, causing a panic, due to malformed ASN.1 being passed to any of the ASN1 methods of String. Tested on linux/386 and darwin/amd64. This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof test vectors. Change-Id: I8c9696a8bfad1b40ec877cd740dba3467d66ab54 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/645211 Reviewed-by: Katie Hockman <firstname.lastname@example.org> Reviewed-by: Adam Langley <email@example.com> x/crypto/cryptobyte is used in crypto/x509 for parsing certificates. Malformed certificates might cause a panic during parsing on 32-bit architectures (like arm and 386). Change-Id: I840feb54eba880dbb96780ef7adcade073c4c4e3 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/647741 Reviewed-by: Katie Hockman <firstname.lastname@example.org>
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
Official binary distributions are available at https://golang.org/dl/.
If a binary distribution is not available for your combination of operating system and architecture, visit https://golang.org/doc/install/source or load doc/install-source.html in your web browser for source installation instructions.
Go is the work of thousands of contributors. We appreciate your help!
To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html
Note that the Go project uses the issue tracker for bug reports and proposals only. See https://golang.org/wiki/Questions for a list of places to ask questions about the Go language.