Skip to content
Permalink
Browse files

[release-branch.go1.13-security] crypto/dsa: prevent bad public keys …

…from causing panic

dsa.Verify might currently use a nil s inverse in a
multiplication if the public key contains a non-prime Q,
causing a panic. Change this to check that the mod
inverse exists before using it.

Fixes CVE-2019-17596

Change-Id: I94d5f3cc38f1b5d52d38dcb1d253c71b7fd1cae7
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/572809
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit 9119dfb0511326d4485b248b83d4fde19c95d0f7)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/575233
  • Loading branch information...
katiehockman committed Oct 14, 2019
1 parent b17fd8e commit 4cabf6992e98f74a324e6f814a7cb35e41b05f25
Showing with 3 additions and 0 deletions.
  1. +3 −0 src/crypto/dsa/dsa.go
@@ -279,6 +279,9 @@ func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {
}

w := new(big.Int).ModInverse(s, pub.Q)
if w == nil {
return false
}

n := pub.Q.BitLen()
if n&7 != 0 {

0 comments on commit 4cabf69

Please sign in to comment.
You can’t perform that action at this time.