NetSight
IP …
high7.5

CVE-2019-17596

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key.

Impact

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Affected products

VendorProductAffected versions
GolangGo
from 1.12 before 1.12.11
from 1.13 before 1.13.2
DebianDebian Linux
Versions 9.0, 10.0
FedoraprojectFedora
Versions 30, 31
RedhatDeveloper Tools
Version 1.0
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Server
Version 8.1
OpensuseLeap
Versions 15.0, 15.1
AristaCloudvision Portal
from 2018.1.0 through 2018.2.3
Versions 2019.1.0, 2019.1.1, 2019.1.2
AristaTerminattr
through 1.7.2
AristaEos
through 4.23.1f
AristaMos
through 0.25

Weakness classification

CWE-436

References