CVE-2019-17596: High severity Golang Go vulnerability
As announced by Go upstream on 2019-10-17: Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don’t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected.
Moreover, an application might crash invoking crypto/x509.(CertificateRequest) CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key.
Upstream bug: https://github.com/golang/go/issues/34960
Other sources
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios such as traffic from a client to a server that verifies client certificates.
— Microsoft
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-17596?
CVE-2019-17596 is a vulnerability in Go before 1.12.11 and 1.3.x before 1.13.2 that can cause a panic when processing network traffic with an invalid DSA public key.
What is the severity of CVE-2019-17596?
The severity of CVE-2019-17596 is high with a severity value of 7.5.
Which software versions are affected by CVE-2019-17596?
Versions 1.11.6-1+deb10u4, 1.11.6-1+deb10u7, 1.13.2, and versions between 1.12 and 1.12.11 (inclusive) are affected.
How can CVE-2019-17596 be exploited?
CVE-2019-17596 can be exploited by sending network traffic with an invalid DSA public key, leading to a panic in the Go application.
Where can I find more information about CVE-2019-17596?
More information about CVE-2019-17596 can be found at the following references: [1](http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html), [2](http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html), [3](https://access.redhat.com/errata/RHSA-2020:0101)