CVE-2019-17596
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - cve@mitre.org
- Published
- 2019-10-24
- Last modified
- 2024-08-05
- Weaknesses
- CWE-436
Affected products
- Cloudvision Portal (Arista)
- Eos (Arista)
- Mos (Arista)
- Terminattr (Arista)
- Debian Linux (Debian)
- Fedora (Fedoraproject)
- Go (Golang)
- Leap (Opensuse)
- Developer Tools (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Server (Redhat)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html
- https://access.redhat.com/errata/RHSA-2020:0101
- https://access.redhat.com/errata/RHSA-2020:0329
- https://github.com/golang/go/issues/34960
- https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZ…
- https://security.netapp.com/advisory/ntap-20191122-0005/
- https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46
- https://www.debian.org/security/2019/dsa-4551
