Skip to content
Browse files
[release-branch.go1.13-security] crypto/dsa: prevent bad public keys …
…from causing panic

dsa.Verify might currently use a nil s inverse in a
multiplication if the public key contains a non-prime Q,
causing a panic. Change this to check that the mod
inverse exists before using it.

Fixes CVE-2019-17596

Change-Id: I94d5f3cc38f1b5d52d38dcb1d253c71b7fd1cae7
Reviewed-by: Filippo Valsorda <>
(cherry picked from commit 9119dfb0511326d4485b248b83d4fde19c95d0f7)
  • Loading branch information
katiehockman committed Oct 16, 2019
1 parent b17fd8e commit 4cabf6992e98f74a324e6f814a7cb35e41b05f25
Showing with 3 additions and 0 deletions.
  1. +3 −0 src/crypto/dsa/dsa.go
@@ -279,6 +279,9 @@ func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {

w := new(big.Int).ModInverse(s, pub.Q)
if w == nil {
return false

n := pub.Q.BitLen()
if n&7 != 0 {

0 comments on commit 4cabf69

Please sign in to comment.