Skip to content
Fencer Vulns
critical 9.1

CVE-2022-23806 json

Incorrect computation for some invalid field elements in crypto/elliptic

published 2022-02-11 4 y ago modified 2026-09-08 2 mo ago also BIT-golang-2022-23806 , EUVD-2022-28738 , GO-2021-0319

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Patch / fix

  • bitnami golang 1.16.14, 1.17.7
  • go stdlib 1.16.14, 1.17.7
  • golang go 1.16.14, 1.17.7
  • golang-1.15 Debian 11 1.15.15-1~deb11u3

debian advisories DEBIAN-CVE-2022-23806

  • delve RHEL 8 1.7.2-1.module+el8.6.0+12972+ebab5911
  • golang RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • go-toolset RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-bin RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-src RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-misc RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-race RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-tests RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19

red hat advisories RHSA-2022:1819RHSA-2022:6094RHSA-2022:5068RHSA-2022:5004RHSA-2022:5729RHSA-2022:4860

  • google-guest-agent SLE Module for Public Cloud 12 20230221.00-1.29.1
  • google-osconfig-agent SLE Module for Public Cloud 15 SP4, SLE Module for Public Cloud 15 SP3, SLE Module for Public Cloud 15 SP2 +2 more 20230222.00-150000.1.27.1
  • google-osconfig-agent SLE Module for Public Cloud 12 20230222.00-1.20.1
  • google-guest-agent SLE Module for Public Cloud 15 SP4, SLE Module for Public Cloud 15 SP3, SLE Module for Public Cloud 15 SP2 +2 more 20230221.00-150000.1.34.1
  • go1.16 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +8 more 1.16.14-1.43.1
  • go1.17 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +8 more 1.17.7-1.20.1

suse advisories SUSE-SU-2023:0603-1SUSE-SU-2023:0602-1SUSE-SU-2023:0601-1SUSE-SU-2023:0600-1SUSE-SU-2022:0724-1SUSE-SU-2022:0723-1

  • go1.16 openSUSE Tumbleweed 1.16.14-1.1
  • go1.17 openSUSE Tumbleweed 1.17.7-1.1
  • go1.16 openSUSE Leap 15.3 1.16.14-1.43.1
  • go1.17 openSUSE Leap 15.3 1.17.7-1.20.1

opensuse advisories openSUSE-SU-2024:11843-1openSUSE-SU-2024:11844-1openSUSE-SU-2022:0724-1openSUSE-SU-2022:0723-1

  • delve AlmaLinux 8 1.7.2-1.module_el8.6.0+2736+ec10aba8
  • golang AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • go-toolset AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-bin AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-src AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-misc AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-race AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-tests AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8

almalinux advisories ALSA-2022:1819

  • delve Rocky Linux 8 1.7.2-1.module+el8.6.0+824+8e984c20
  • golang Rocky Linux 8 1.17.7-1.module+el8.6.0+824+8e984c20
  • go-toolset Rocky Linux 8 1.17.7-1.module+el8.6.0+824+8e984c20

rocky linux advisories RLSA-2022:1819

  • go Alpine 3.14 1.16.15-r0
  • go Alpine 3.15 1.17.9-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.17.7-r0

alpine advisories ALPINE-CVE-2022-23806

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.18.8-3

azure linux advisories AZL-8524

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23806 updated cvss 7.1

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/eventrouter-rhel9, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/log-file-metric-exporter-rhel8 Red Hat Migration Toolkit for Containers mtc-1.6, rhmtc/openshift-migration-must-gather-rhel8 Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat OpenShift API for Data Protection oadp/oadp-velero-plugin-rhel8
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services ocp-tools-4/service-binding-operator-bundle
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh-proxy, servicemesh-grafana, servicemesh-grafana-prometheus Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/gatekeeper-rhel8, rhacm2/agent-service-rhel8, rhacm2/search-collector-rhel9, gatekeeper/gatekeeper-rhel9-operator, rhacm2/thanos-receive-controller-rhel8 Red Hat Ansible Automation Platform 1.2 golang Red Hat Ansible Automation Platform 2 golang
    affected: no fix available
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 faq, openshift, prometheus-promu, openshift-clients, openshift-kubelet, openshift-hyperkube, +8 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Data Foundation 4 odf4/ocs-rhel9-operator, odf4/ocs-must-gather-rhel9, odf4/odf-multicluster-rhel9-operator
    affected: no fix available
show 17 more
  • Red Hat OpenShift Virtualization 2 hyperconverged-cluster-webhook-container
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Virtualization 4 kubevirt, kubevirt-velero-plugin-container, container-native-virtualization/kubemacpool, container-native-virtualization/virt-api-rhel9, container-native-virtualization/virt-cdi-uploadserver, container-native-virtualization/virt-controller-rhel9, +3 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.1 etcd, golang-qpid-apache
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 16.2 etcd, golang-qpid-apache
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8, quay/clair-rhel8, quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-openshift-bridge-rhel8-operator, quay/quay-container-security-operator-rhel8
    affected: no fix available
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8 Red Hat Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 git-lfs
    under investigation
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virt-api v4.12.0-255, container-native-virtualization/virt-handler v4.12.0-255, container-native-virtualization/virt-launcher v4.12.0-255, container-native-virtualization/virt-operator v4.12.0-255, container-native-virtualization/virt-controller v4.12.0-255, container-native-virtualization/virt-artifacts-server v4.12.0-255
    fixed: vendor fix RHSA-2023:0408
  • Red Hat OpenShift Service Mesh 2.1 servicemesh 2.1.3-1.el8, servicemesh-cni 2.1.3-1.el8, servicemesh-proxy 2.1.3-1.el8, servicemesh-operator 2.1.3-2.el8, servicemesh-ratelimit 2.1.3-1.el8, servicemesh-proxy-wasm 2.1.3-1.el8, +4 more
    fixed: vendor fix RHSA-2022:5006
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.7.2-1.module+el8.6.0+12972+ebab5911, golang 1.17.7-1.module+el8.6.0+14297+32a15e19, go-toolset 1.17.7-1.module+el8.6.0+14297+32a15e19, golang-bin 1.17.7-1.module+el8.6.0+14297+32a15e19, golang-src 1.17.7-1.module+el8.6.0+14297+32a15e19, golang-misc 1.17.7-1.module+el8.6.0+14297+32a15e19, +2 more
    fixed: vendor fix RHSA-2022:1819
  • Red Hat OpenShift Container Platform 4.10 cri-tools 1.23.0-1.1.el7, cri-tools 1.23.0-1.1.el8, cri-o 1.23.3-13.rhaos4.10.git6af791c.1.el7, cri-o 1.23.3-14.rhaos4.10.git6af791c.1.el8, openshift4/ose-cli v4.10.0-202207291908.p0.ge29d58e.assembly.stream, openshift4/ose-pod v4.10.0-202207291908.p0.g012e945.assembly.stream, +155 more
    fixed: vendor fix RHSA-2022:6094
  • Red Hat OpenShift Container Platform 4.11 buildah 1.23.4-2.el8, buildah-tests 1.23.4-2.el8, runc 1.1.2-1.rhaos4.11.el8, podman 4.0.2-6.rhaos4.11.el8, skopeo 1.5.2-3.rhaos4.11.el8, butane 0.15.0-1.rhaos4.11.el8, +12 more
    fixed: vendor fix RHSA-2022:5068
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.1.0-3.el8
    fixed: vendor fix RHSA-2022:4860
  • Red Hat OpenShift Serverless 1.22 openshift-serverless-1/client-kn-rhel8 1.1.0-4, openshift-serverless-1/serving-queue-rhel8 1.1.2-3, openshift-serverless-1/eventing-mtping-rhel8 1.1.0-3, openshift-serverless-1/kourier-control-rhel8 1.1.0-3, openshift-serverless-1/serving-webhook-rhel8 1.1.2-3, openshift-serverless-1/eventing-webhook-rhel8 1.1.0-3, +32 more
    fixed: vendor fix RHSA-2022:4863
  • Red Hat RHODF 4.11 for RHEL 8 odf4/ocs-rhel8-operator v4.11.0-67, odf4/ocs-must-gather-rhel8 v4.11.0-66, odf4/rook-ceph-rhel8-operator v4.11.0-49, odf4/odf-multicluster-console-rhel8 v4.11.0-45, odf4/odf-multicluster-rhel8-operator v4.11.0-29
    fixed: vendor fix RHSA-2022:6156
  • Red Hat Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8 5.1.1-2
    fixed: vendor fix RHSA-2023:1529
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virtio-win v4.12.0-10, container-native-virtualization/kubemacpool v4.12.0-24, container-native-virtualization/bridge-marker v4.12.0-24, container-native-virtualization/ovs-cni-marker v4.12.0-24, container-native-virtualization/ovs-cni-plugin v4.12.0-24, container-native-virtualization/virt-cdi-cloner v4.12.0-72, +31 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 pysnmp 4.4.8-3.el8, pyparsing 2.3.1-2.el8, libsodium 1.0.16-5.el8, python-pbr 5.5.1-2.el8, python-yappi 1.0-3.el8, python-amqp 2.5.2-8.el8, +273 more Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/pilot-rhel8 2.1.3-1, openshift-service-mesh/grafana-rhel8 2.1.3-1, openshift-service-mesh/proxyv2-rhel8 2.1.3-1, openshift-service-mesh/istio-cni-rhel8 2.1.3-1, openshift-service-mesh/ratelimit-rhel8 2.1.3-1, openshift-service-mesh/prometheus-rhel8 2.1.3-1, +3 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/memcached-exporter-rhel9, rhacm2/multicloud-manager-rhel8 Red Hat Enterprise Linux 9 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat OpenShift Container Platform 4.10 NetworkManager 1.30.0-16.el8_4, NetworkManager-ovs 1.30.0-16.el8_4, NetworkManager-ppp 1.30.0-16.el8_4, NetworkManager-tui 1.30.0-16.el8_4, NetworkManager-adsl 1.30.0-16.el8_4, NetworkManager-team 1.30.0-16.el8_4, +49 more
    not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.07% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.16.14
>=1.17.0, <1.17.7
1.16.14
1.17.7
go stdlib
<1.16.14
>=1.17.0-0, <1.17.7
1.16.14
1.17.7

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.