CVE-2019-17596
HIGH severity · CVSS 7.5 · CWE-436
7.5CVSS HIGH
Summary
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)5%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: https://github.com/golang/go/issues/34960 ↗
Additional information
- NVD record
- https://github.com/golang/go/issues/34960Patch
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.htmlAdvisory
- https://access.redhat.com/errata/RHSA-2020:0101Advisory
- https://access.redhat.com/errata/RHSA-2020:0329Advisory
- https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJAdvisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlAdvisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlAdvisory