commit 35bb62e60a7779ff82c3067903b3306ff8666471 [browse]
Author: Julie Qiu
Date: 2019-01-23 14:07:54 -05:00

[release-branch.go1.11-security] go1.11.5

Change-Id: Ib957fc19ae0633f77e2a5a9219f7a11ceda3f092
Reviewed-on: https://team-review.git.corp.google.com/c/400909
Reviewed-by: Filippo Valsorda <valsorda@google.com>

commit daef79d40510df2708dba127bb0721fb8548bc9e [browse]
Author: Ian Lance Taylor
Date: 2019-01-11 14:26:24 -08:00

[release-branch.go1.11-security] net: pass if at least one matching entry in TestLookupGmailTXT

Fixes #29698

Change-Id: I0531c0a274b120af8871aa2f5975744ff6c912a3
Reviewed-on: https://go-review.googlesource.com/c/157638
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-on: https://team-review.git.corp.google.com/c/401203
Reviewed-by: Filippo Valsorda <valsorda@google.com>

commit 983d8092ef8cc5c92c5a598baf1b7a5dbfd51ef4 [browse]
Author: Julie Qiu
Date: 2019-01-23 12:39:16 -05:00

[release-branch.go1.11-security] doc: document Go 1.11.5 and Go 1.10.8

Change-Id: I97ce42e1e9a6d10bf1eeccc2763e043d8ebe5bab
Reviewed-on: https://team-review.git.corp.google.com/c/400906
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit efe766c7c0918da96aa21e1ac03a9d3fa57ca156)
Reviewed-on: https://team-review.git.corp.google.com/c/401144

commit 42b42f71cf8f5956c09e66230293dfb5db652360 [browse]
Author: Filippo Valsorda
Date: 2019-01-22 16:02:41 -05:00

[release-branch.go1.11-security] crypto/elliptic: reduce subtraction term to prevent long busy loop

If beta8 is unusually large, the addition loop might take a very long
time to bring x3-beta8 back positive.

This would lead to a DoS vulnerability in the implementation of the
P-521 and P-384 elliptic curves that may let an attacker craft inputs
to ScalarMult that consume excessive amounts of CPU.

This fixes CVE-2019-6486.

Change-Id: Ia969e8b5bf5ac4071a00722de9d5e4d856d8071a
Reviewed-on: https://team-review.git.corp.google.com/c/399777
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
(cherry picked from commit 746d6abe2dfb9ce7609f8e1e1a8dcb7e221f423e)
Reviewed-on: https://team-review.git.corp.google.com/c/401142
Reviewed-by: Filippo Valsorda <valsorda@google.com>

commit 4601a4c1b1c00fbe507508f0267ec5a9445bb7e5 [browse]
Author: Filippo Valsorda
Date: 2018-12-14 16:59:51 -05:00

[release-branch.go1.11] go1.11.4

Change-Id: Id4fe02a5b26da92e99d9817ecbf518682c4345b2
Reviewed-on: https://go-review.googlesource.com/c/154307
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>