[release-branch.go1.11] all: merge release-branch.go1.11-security into release-branch.go1.11

Change-Id: Ic59638be13c6dadeccd5974ec6cd9ef4b5b4b526

3 files changed, 17 insertions, 2 deletions

diff --git a/VERSION b/VERSION
index 2506b03408..04364e1646 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-go1.11.4
\ No newline at end of file
+go1.11.5
\ No newline at end of file
diff --git a/doc/devel/release.html b/doc/devel/release.html
index 73f7a0e304..226148e93b 100644
--- a/doc/devel/release.html
+++ b/doc/devel/release.html
@@ -66,6 +66,13 @@ See the <a href="https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+labe
 1.11.4 milestone</a> on our issue tracker for details.
 </p>
 
+<p>
+go1.11.5 (released 2019/01/23) includes a security fix to the
+<code>crypto/elliptic</code> package.
+See the <a href="https://github.com/golang/go/issues?q=milestone%3AGo1.11.5+label%3ACherryPickApproved">Go
+1.11.5 milestone</a> on our issue tracker for details.
+</p>
+
 <h2 id="go1.10">go1.10 (released 2018/02/16)</h2>
 
 <p>
@@ -131,6 +138,13 @@ See the <a href="https://github.com/golang/go/issues?q=milestone%3AGo1.10.7+labe
 Go 1.10.7 milestone</a> on our issue tracker for details.
 </p>
 
+<p>
+go1.10.8 (released 2019/01/23) includes a security fix to the
+<code>crypto/elliptic</code> package.
+See the <a href="https://github.com/golang/go/issues?q=milestone%3AGo1.10.8+label%3ACherryPickApproved">Go
+1.10.8 milestone</a> on our issue tracker for details.
+</p>
+
 <h2 id="go1.9">go1.9 (released 2017/08/24)</h2>
 
 <p>
diff --git a/src/crypto/elliptic/elliptic.go b/src/crypto/elliptic/elliptic.go
index 4fc2b5e521..c84657c5e3 100644
--- a/src/crypto/elliptic/elliptic.go
+++ b/src/crypto/elliptic/elliptic.go
@@ -210,8 +210,9 @@ func (curve *CurveParams) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int,
 
 	x3 := new(big.Int).Mul(alpha, alpha)
 	beta8 := new(big.Int).Lsh(beta, 3)
+	beta8.Mod(beta8, curve.P)
 	x3.Sub(x3, beta8)
-	for x3.Sign() == -1 {
+	if x3.Sign() == -1 {
 		x3.Add(x3, curve.P)
 	}
 	x3.Mod(x3, curve.P)