GitHub Advisoryadvisory · Go

GHSA-gv9j-4w24-q7vx Improper random number generation in github.com/coredns/coredns

MEDIUM Published 2022-03-01 Modified 2022-03-01 Official page ↗
Ecosystem
Go
Packages
github.com/coredns/coredns
Severity
Moderate
Weaknesses
CWE-330
Reviewed
2022-03-01

Affected packages

• Go github.com/coredns/coredns: < 1.6.6 → fixed in 1.6.6

Description

Impact CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries. Patches The problem has been fixed in 1.6.6+. References • CVE-2019-19794 For more information Please consult our security guide for more information regarding our security process.

Related

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References