CVE-2019-19794

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-338

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/coredns/coredns/issues/3519Issue Tracking, Third Party Advisory
https://github.com/coredns/coredns/issues/3547Third Party Advisory
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25Release Notes, Third Party Advisory
https://github.com/miekg/dns/issues/1043Exploit, Issue Tracking, Third Party Advisory
https://github.com/miekg/dns/pull/1044Patch, Third Party Advisory
https://github.com/coredns/coredns/issues/3519Issue Tracking, Third Party Advisory
https://github.com/coredns/coredns/issues/3547Third Party Advisory
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25Release Notes, Third Party Advisory
https://github.com/miekg/dns/issues/1043Exploit, Issue Tracking, Third Party Advisory
https://github.com/miekg/dns/pull/1044Patch, Third Party Advisory

Timeline

Published: Dec 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-197957.8samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file.CVE-2019-197967.8Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file.CVE-2019-197975.5read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.CVE-2019-197995.3Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via Wie CVE-2019-19805.3A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, a CVE-2019-198005.3Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelper CVE-2019-198015.5In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5)CVE-2019-198026.5In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prio CVE-2019-198055.3_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether CVE-2019-198065.3_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is confi CVE-2019-198077.8In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This CVE-2019-19815.8A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, an