CVE-2019-17596

Published: Oct 24, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Affected (18)

Products: Golang: Go · Debian: Debian Linux · Fedoraproject: Fedora · +3 more

Show all products

Golang: Go · Debian: Debian Linux · Fedoraproject: Fedora · Redhat: Developer Tools, Enterprise Linux, Enterprise Linux Server · Opensuse: Leap · Arista: Cloudvision Portal, Eos, Mos, Terminattr

1 product

1 product

1 product

3 products

Developer Tools

Enterprise Linux

Enterprise Linux Server

1 product

4 products

Cloudvision Portal

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Golang Go	From 1.12 to 1.12.11
Golang Go	From 1.13 to 1.13.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Developer Tools	Version 1.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Server	Version 8.1

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration F

7 vulnerable

Vulnerable Software	Affected Versions
Arista Cloudvision Portal	From 2018.1.0 to 2018.2.3
Arista Cloudvision Portal	Version 2019.1.0
Arista Cloudvision Portal	Version 2019.1.1
Arista Cloudvision Portal	Version 2019.1.2
Arista Eos	Up to 4.23.1f
Arista Mos	Up to 0.25
Arista Terminattr	Up to 1.7.2

Related CWEs

Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References (26)

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0101

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0329

Source: cve@mitre.org

Third Party Advisory

https://github.com/golang/go/issues/34960

Source: cve@mitre.org

ExploitIssue TrackingPatchThird Party Advisory

https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ

Source: cve@mitre.org

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20191122-0005/

Source: cve@mitre.org

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4551

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0101

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0329

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/golang/go/issues/34960

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20191122-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2019/dsa-4551

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.