Is syncthing affected by [security] Go 1.5.3 / CVE-2015-8618?

[emx (Michael)]

Go just released a security advisory and an update: https://groups.google.com/forum/#!topic/golang-dev/MEATuOi_ei4

Apparently programs compiled with the vulnerable versions of Go could leak private keys during TLS operations.

Is syncthing potentially affected by this?

[calmh (Jakob Borg)]

Yes:

Security update - Syncthing v0.12.14

Continuing the discussion from Upcoming security release of Go: I’ve just pushed and built Syncthing v0.12.14. This build is built with Go 1.5.3, except for the Windows which is built using Go 1.6beta2. Go 1.5.3 / 1.6beta2 fixes the security issue described here, but the relevant part is: Specifically, incorrect results in one part of the RSA Chinese Remainder computation can cause the result to be incorrect in such a way that it leaks one of the primes. While RSA blinding should prevent an a…