CVE-2019-17596
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
| Software | From | Fixed in |
|---|---|---|
| golang / go | 1.13 | 1.13.2 |
| golang / go | 1.12 | 1.12.11 |
| debian / debian_linux | 9.0 | 9.0.x |
| debian / debian_linux | 10.0 | 10.0.x |
| fedoraproject / fedora | 30 | 30.x |
| fedoraproject / fedora | 31 | 31.x |
| redhat / enterprise_linux | 8.0 | 8.0.x |
| redhat / developer_tools | 1.0 | 1.0.x |
| redhat / enterprise_linux_server | 8.1 | 8.1.x |
| opensuse / leap | 15.0 | 15.0.x |
| opensuse / leap | 15.1 | 15.1.x |
| arista / mos | - | 0.25.x |
| arista / eos | - | 4.23.1f.x |
| arista / cloudvision_portal | 2019.1.2 | 2019.1.2.x |
| arista / cloudvision_portal | 2019.1.1 | 2019.1.1.x |
| arista / cloudvision_portal | 2019.1.0 | 2019.1.0.x |
| arista / cloudvision_portal | 2018.1.0 | 2018.2.3.x |
| arista / terminattr | - | 1.7.2.x |
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html
- https://access.redhat.com/errata/RHSA-2020:0101
- https://access.redhat.com/errata/RHSA-2020:0329
- https://github.com/golang/go/issues/34960
- https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/
- https://security.netapp.com/advisory/ntap-20191122-0005/
- https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46
- https://www.debian.org/security/2019/dsa-4551
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime