ALAS2-2019-1172


Amazon Linux 2 Security Advisory: ALAS-2019-1172
Advisory Release Date: 2019-03-08 00:46 Pacific
Severity: Medium
References: CVE-2019-6486 

Issue Overview:

Go mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.(CVE-2019-6486 )

Note: This CVE is also fixed in golang-1.11.3-2.amzn2.0.2 in the golang1.11 extras repository.


Affected Packages:

golang


Issue Correction:
Run yum update golang to update your system.

New Packages:
aarch64:
    golang-1.9.4-3.amzn2.0.1.aarch64
    golang-bin-1.9.4-3.amzn2.0.1.aarch64

noarch:
    golang-docs-1.9.4-3.amzn2.0.1.noarch
    golang-misc-1.9.4-3.amzn2.0.1.noarch
    golang-tests-1.9.4-3.amzn2.0.1.noarch
    golang-src-1.9.4-3.amzn2.0.1.noarch

src:
    golang-1.9.4-3.amzn2.0.1.src

x86_64:
    golang-1.9.4-3.amzn2.0.1.x86_64
    golang-bin-1.9.4-3.amzn2.0.1.x86_64