CVEvulnerability
CVE-2019-17596
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-10-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-436
Description
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
Affected configurations
• golang go (>= 1.12 < 1.12.11)
• golang go (>= 1.13 < 1.13.2)
• debian debian linux 9.0
• debian debian linux 10.0
• fedoraproject fedora 30
• fedoraproject fedora 31
• redhat developer tools 1.0
• redhat enterprise linux 8.0
• redhat enterprise linux server 8.1
• opensuse leap 15.0
• opensuse leap 15.1
• arista cloudvision portal (>= 2018.1.0 <= 2018.2.3)
• arista cloudvision portal 2019.1.0
• arista cloudvision portal 2019.1.1
• arista cloudvision portal 2019.1.2
• arista terminattr (<= 1.7.2)
• arista eos (<= 4.23.1f)
• arista mos (<= 0.25)
Related
Weakness · CWE (1)
- CWE-436 Interpretation Conflict weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0101 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0329 Third Party Advisory
- https://github.com/golang/go/issues/34960 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20191122-0005/ Third Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4551 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0101 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0329 Third Party Advisory
- https://github.com/golang/go/issues/34960 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20191122-0005/ Third Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4551 Third Party Advisory