high
7.5
CWE
436
Advisory Published
CVE Published
Updated

CVE-2019-17596

First published: Fri Oct 18 2019(Updated: )

As announced by Go upstream on 2019-10-17: Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don’t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Moreover, an application might crash invoking crypto/x509.(*CertificateRequest) CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key. Upstream bug: <a href="https://github.com/golang/go/issues/34960">https://github.com/golang/go/issues/34960</a>

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Golang Go>=1.12<1.12.11
Golang Go>=1.13<1.13.2
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Fedoraproject Fedora=30
Fedoraproject Fedora=31
Redhat Developer Tools=1.0
Redhat Enterprise Linux=8.0
Redhat Enterprise Linux Server=8.1
openSUSE Leap=15.0
openSUSE Leap=15.1
Arista CloudVision Portal>=2018.1.0<=2018.2.3
Arista CloudVision Portal=2019.1.0
Arista CloudVision Portal=2019.1.1
Arista CloudVision Portal=2019.1.2
Arista Terminattr<=1.7.2
Arista EOS<=4.23.1f
Arista MOS<=0.25
redhat/go<1.13.2
1.13.2
redhat/go<1.12.11
1.12.11
debian/golang-1.11
1.11.6-1+deb10u4
1.11.6-1+deb10u7

Remedy

https://github.com/golang/go/issues/34960

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2019-17596?

    CVE-2019-17596 is a vulnerability in Go before 1.12.11 and 1.3.x before 1.13.2 that can cause a panic when processing network traffic with an invalid DSA public key.

  • What is the severity of CVE-2019-17596?

    The severity of CVE-2019-17596 is high with a severity value of 7.5.

  • Which software versions are affected by CVE-2019-17596?

    Versions 1.11.6-1+deb10u4, 1.11.6-1+deb10u7, 1.13.2, and versions between 1.12 and 1.12.11 (inclusive) are affected.

  • How can CVE-2019-17596 be exploited?

    CVE-2019-17596 can be exploited by sending network traffic with an invalid DSA public key, leading to a panic in the Go application.

  • Where can I find more information about CVE-2019-17596?

    More information about CVE-2019-17596 can be found at the following references: [1](http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html), [2](http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html), [3](https://access.redhat.com/errata/RHSA-2020:0101)

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203