CVE:CVE-2022-23806
CNNVD:CNNVD-202202-930
Elliptic package是一款基于JavaScript的椭圆曲线密码库。
crypto/elliptic存在安全漏洞，该漏洞源于在Go 1.16.14和1.17之前的IsOnCurve in crypto elliptic。在带有大值的情况下，1.17.7之前的X可能不正确地返回true。非有效字段元素的整型值。
solution:Upgrade golang go to a higher version than 1.16.14,1.17.7,and avoid the version (,1.16.14),[1.17.0,1.17.7); Upgrade netapp beegfs_csi_driver to a higher version than -; Upgrade netapp cloud_insights_telegraf_agent to a higher version than -; Upgrade netapp kubernetes_monitoring_operator to a higher version than -; Upgrade netapp storagegrid to a higher version than -; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0