The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1…
Priority MEDIUM 40Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 20 fixed, 35 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
Why it matters now
EPSS 0.0416 90th percentileScored 2026-11-07
Fix Partial Red Hat: 25 advisoriesRed Hat: 20 fixed, 35 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.17.9; 1.18.0 to before 1.18.1 | Vulnerable | Go standard library |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Fedoraproject |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.9; 1.18.0 to before 1.18.1 Vulnerable ·Go standard library
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Fedoraproject
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
Remediation
Red Hat 25 advisories
- RHSA-2023:4003 Released 2023-07-10 · Red Hat rating ModerateRed Hat Service Interconnect 1.4 Release security update
- Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
- Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
- RHSA-2023:3914 Released 2023-07-06 · Red Hat rating ImportantRed Hat OpenShift Enterprise security update
- Red Hat OpenShift Container Platform 4.11 buildah-1:1.23.4-3.rhaos4.11.el8, buildah-tests-1:1.23.4-3.rhaos4.11.el8, openshift-4.11.0-202306260054.p0.g990d55b.assembly.stream.el8 +12
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
Show 22 more Red Hat advisories
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2023:1042 Released 2023-03-06 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
- RHSA-2022:8750 Released 2022-12-01 · Red Hat rating ModerateOpenShift Virtualization 4.11.1 security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6714 Released 2022-09-26 · Red Hat rating ModerateRHACS 3.72 enhancement and security update
- RHACS 3.72 for RHEL 8 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +3
- RHSA-2022:6526 Released 2022-09-14 · Red Hat rating ImportantOpenShift Virtualization 4.11.0 Images security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6152 Released 2022-09-01 · Red Hat rating ImportantSecondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2022:6290 Released 2022-09-01 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.0 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-rhel8-operator +8
- RHSA-2022:6277 Released 2022-08-31 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.1.5 security update
- OpenShift Service Mesh 2.1 servicemesh-2.1.5-1.el8, servicemesh-cni-2.1.5-1.el8, servicemesh-operator-2.1.5-1.el8 +6
- RHSA-2022:6187 Released 2022-08-25 · Red Hat rating ImportantNode Health Check Operator 0.3.1 security update
- Node Healthcheck Operator 0.3 for RHEL 8 workload-availability/node-healthcheck-rhel8-operator
- RHSA-2022:6156 Released 2022-08-24 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
- RHSA-2022:6155 Released 2022-08-24 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.11.0 security, enhancement & bugfix update
- RHODF 4.11 for RHEL 8 mcg-5.11.0-22.el8, mcg-redistributable-5.11.0-22.el8
- RHSA-2022:6094 Released 2022-08-23 · Red Hat rating ModerateOpenShift Container Platform 4.10.28 packages and security update
- Red Hat OpenShift Container Platform 4.10 cri-o-1.23.3-13.rhaos4.10.git6af791c.1.el7, cri-o-1.23.3-14.rhaos4.10.git6af791c.1.el8
- RHSA-2022:6040 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless 1.24.0
- Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
- RHSA-2022:6042 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless Client kn 1.24.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
- RHSA-2022:5068 Released 2022-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.11.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
- Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47
- RHSA-2022:5875 Released 2022-08-09 · Red Hat rating ModerateOpenShift Container Platform 4.10.26 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:5840 Released 2022-08-02 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.3 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8 +7
- RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Importantgo-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
- RHSA-2022:5729 Released 2022-08-01 · Red Hat rating ModerateOpenShift Container Platform 4.10.25 security update
- Red Hat OpenShift Container Platform 4.10 atomic-openshift-service-idler-4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el7, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 +10
- RHSA-2022:5337 Released 2022-06-30 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.10-1.module+el8.6.0+15486+6d4da7db.aarch64::go-toolset:rhel8 +18
- RHSA-2022:5415 Released 2022-06-30 · Red Hat rating Moderatego-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-golang-1.17.10-1.el7_9, go-toolset-1.17-golang-bin-1.17.10-1.el7_9, go-toolset-1.17-golang-docs-1.17.10-1.el7_9 +4
- RHSA-2022:5006 Released 2022-06-13 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.1.3 Containers security update
- OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-OADP-1.1 | Fixed | RHSA-2022:6290 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:5840 |
| CNV 4.11 for RHEL 8 | Fixed | RHSA-2022:6526, RHSA-2022:8750 |
| Node Healthcheck Operator 0.3 for RHEL 8 | Fixed | RHSA-2022:6187 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2022:6152 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2023:1042 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:5006, RHSA-2022:6277 |
| RHACS 3.72 for RHEL 8 | Fixed | RHSA-2022:6714 |
| RHODF 4.11 for RHEL 8 | Fixed | RHSA-2022:6155, RHSA-2022:6156 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2022:5415 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:5337 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:5799 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:5729, RHSA-2022:5875, RHSA-2022:6094 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5068, RHSA-2023:3914 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:6042 |
| Red Hat OpenShift Serverless 1.24 | Fixed | RHSA-2022:6040 |
| Red Hat Service Interconnect | Fixed | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2023:4003 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 19 products
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.11 for RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.11
- Node Healthcheck Operator 0.3 for RHEL 8
- OSSO 1.1 for RHEL 8
- OpenShift Custom Metrics Autoscaler 2
- OpenShift Service Mesh 2.1
- RHACS 3.72 for RHEL 8
- RHODF 4.11 for RHEL 8
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenStack Platform 16.2
- Red Hat Service Interconnect
- Red Hat Service Interconnect 1
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28327
- 2026-10-03 Alias added: GHSA-v5qw-m6mv-3q79
References
Advisory 11
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8
- FEDORA-2022-a49babed75
- FEDORA-2022-53f0c619c5
- FEDORA-2022-c0f780ecf1
- FEDORA-2022-e46e6e8317
- FEDORA-2022-fae3ecee19
- FEDORA-2022-ba365d3703
- GLSA-202208-02
- FEDORA-2022-30c5ed5625
- https://security.netapp.com/advisory/ntap-20220915-0010/
Sources
- CVE-2022-28327 · CVE Program
- CVE-2022-28327 · NVD
- FIRST EPSS
- GHSA-v5qw-m6mv-3q79 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-28327 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences