Description
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.htmlMailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0101Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0329Third Party Advisory
- https://github.com/golang/go/issues/34960Exploit, Issue Tracking, Patch, Third Party Advisory
- https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJRelease Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/
- https://security.netapp.com/advisory/ntap-20191122-0005/Third Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46Third Party Advisory
- https://www.debian.org/security/2019/dsa-4551Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.htmlMailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0101Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0329Third Party Advisory
- https://github.com/golang/go/issues/34960Exploit, Issue Tracking, Patch, Third Party Advisory
- https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJRelease Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/
- https://security.netapp.com/advisory/ntap-20191122-0005/Third Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46Third Party Advisory
- https://www.debian.org/security/2019/dsa-4551Third Party Advisory
Timeline
- Published
- Oct 24, 2019
- Last modified
- Jun 17, 2026
- NVD status
- Modified