Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can…
Priority MEDIUM 45CWE-252Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 9 fixed, 25 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
Why it matters now
EPSS 0.03073 87th percentileScored 2026-11-07
Fix Partial Red Hat: 15 advisoriesRed Hat: 9 fixed, 25 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.16.14; 1.17.0 to before 1.17.7 | Vulnerable | Go standard library |
| cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.16.14; 1.17.0 to before 1.17.7 Vulnerable ·Go standard library
- cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
Red Hat 15 advisories
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
- RHSA-2022:6526 Released 2022-09-14 · Red Hat rating ImportantOpenShift Virtualization 4.11.0 Images security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
Show 12 more Red Hat advisories
- RHSA-2022:6156 Released 2022-08-24 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
- RHSA-2022:6094 Released 2022-08-23 · Red Hat rating ModerateOpenShift Container Platform 4.10.28 packages and security update
- Red Hat OpenShift Container Platform 4.10 cri-o-1.23.3-13.rhaos4.10.git6af791c.1.el7, cri-o-1.23.3-14.rhaos4.10.git6af791c.1.el8
- RHSA-2022:5068 Released 2022-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.11.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
- Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47
- RHSA-2022:5875 Released 2022-08-09 · Red Hat rating ModerateOpenShift Container Platform 4.10.26 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:5729 Released 2022-08-01 · Red Hat rating ModerateOpenShift Container Platform 4.10.25 security update
- Red Hat OpenShift Container Platform 4.10 atomic-openshift-service-idler-4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el7, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 +10
- RHSA-2022:5201 Released 2022-06-27 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.5 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
- RHSA-2022:5006 Released 2022-06-13 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.1.3 Containers security update
- OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
- RHSA-2022:5004 Released 2022-06-13 · Red Hat rating CriticalRed Hat OpenShift Service Mesh 2.1.3 security update
- OpenShift Service Mesh 2.1 servicemesh-2.1.3-1.el8, servicemesh-cni-2.1.3-1.el8, servicemesh-operator-2.1.3-2.el8 +6
- RHSA-2022:4956 Released 2022-06-09 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
- RHSA-2022:4863 Released 2022-06-01 · Red Hat rating ModerateRelease of OpenShift Serverless Version 1.22.1
- Red Hat OpenShift Serverless 1.22 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
- RHSA-2022:4860 Released 2022-06-01 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.22.1
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.1.0-3.el8
- RHSA-2022:1819 Released 2022-05-10 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.7-1.module+el8.6.0+14297+32a15e19.aarch64::go-toolset:rhel8 +18
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| OpenShift API for Data Protection | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0408 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:5004, RHSA-2022:5006 |
| RHODF 4.11 for RHEL 8 | Fixed | RHSA-2022:6156 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:1819 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:5729, RHSA-2022:5875, RHSA-2022:6094 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5068 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:4860 |
| Red Hat OpenShift Serverless 1.22 | Fixed | RHSA-2022:4863 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 11 products
- CNV 4.12 for RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.11
- OpenShift Service Mesh 2.1
- RHODF 4.11 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift GitOps
- Red Hat OpenShift on AWS
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23806
- 2026-10-03 Alias added: GHSA-8c83-vp4v-h7fq
References
Advisory 6
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- https://security.netapp.com/advisory/ntap-20220225-0006/
- GLSA-202208-02
Sources
- CVE-2022-23806 · CVE Program
- CVE-2022-23806 · NVD
- FIRST EPSS
- GHSA-8c83-vp4v-h7fq · GitHub Advisory Database · CC BY 4.0
- CVE-2022-23806 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences