golang-1.8.3-1.el7

The golang packages provide the Go programming language compiler.

The following packages have been upgraded to a later upstream version: golang
(1.8.3). (BZ#1414500)

Security Fix(es):

* A carry propagation flaw was found in the implementation of the P-256
elliptic curve in golang. An attacker could possibly use this flaw to extract
private keys when static ECDH was used. (CVE-2017-8932)

Additional Changes:

For detailed information on changes in this release, see the Asianux Server
7.4 Release Notes linked from the References section.

CVE-2017-8932
A bug in the standard library ScalarMult implementation of curve P-256
for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2
causes incorrect results to be generated for specific input points. An
adaptive attack can be mounted to progressively extract the scalar
input to ScalarMult by submitting crafted points and observing
failures to the derive correct output. This leads to a full key
recovery attack against static ECDH, as used in popular JWT libraries.