7.5high
CVE-2019-17596
Panic on invalid DSA public keys in crypto/dsa
Also known as GO-2022-0213
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
4.7%
percentile 92%
Public exploits
0
none known
Summary
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
Exploit prediction (EPSS)
4.69% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | stdlib | <1.12.11 >=1.13.0-0, <1.13.2 | 1.12.11 1.13.2 |
Classification
- Weakness
- CWE-436 Interpretation Conflict
References
- groups.google.com /d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ · x_refsource_CONFIRM, x_transferred
- github.com /golang/go/issues/34960 · x_refsource_CONFIRM, x_transferred
- debian.org /security/2019/dsa-4551 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67 · vendor-advisory, x_refsource_FEDORA, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ · vendor-advisory, x_refsource_FEDORA, x_transferred
- lists.opensuse.org /opensuse-security-announce/2019-11/msg00043.html · vendor-advisory, x_refsource_SUSE, x_transferred
- lists.opensuse.org /opensuse-security-announce/2019-11/msg00044.html · vendor-advisory, x_refsource_SUSE, x_transferred
- security.netapp.com /advisory/ntap-20191122-0005/ · x_refsource_CONFIRM, x_transferred
- access.redhat.com /errata/RHSA-2020:0101 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2020:0329 · vendor-advisory, x_refsource_REDHAT, x_transferred
- lists.debian.org /debian-lts-announce/2021/03/msg00014.html · mailing-list, x_refsource_MLIST, x_transferred
- lists.debian.org /debian-lts-announce/2021/03/msg00015.html · mailing-list, x_refsource_MLIST, x_transferred
- arista.com /en/support/advisories-notices/security-advisories/10134-security-advisory-46 · x_refsource_MISC, x_transferred
- go.dev /cl/205441 · fix
- go.googlesource.com /go/+/552987fdbf4c2bc9641016fd323c3ae5d3a0d9a3 · fix
- go.dev /issue/34960 · report
- groups.google.com /g/golang-announce/c/lVEm7llp0w0/m/VbafyRkgCgAJ · web
Sources
- CVE List: CVE-2019-17596
- NVD: CVE-2019-17596
- OSV: GO-2022-0213
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.