CVE-2019-17596

Published: 24 October 2019

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Notes

Packages built using golang need to be rebuilt once the
vulnerability has been fixed. This CVE entry does not
list packages that need rebuilding outside of the main
repository or the Ubuntu variants with PPA overlays.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17596
• https://golang.org/issue/34960
• https://github.com/golang/go/issues/34962 (1.13 backport)
• https://github.com/golang/go/issues/34961 (1.12 backport)
• NVD
• Launchpad
• Debian

Bugs

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942629
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942628