High severity · published Oct 24, 2019
CVE-2019-17596
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key
7.5
CVSS
4.7%
EPSS
No
On KEV
Description
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cloudvision Portal · Arista
2018.1.0 through 2018.2.3; 2019.1.0; 2019.1.1; 2019.1.2 · source: NVD
DL
Debian Linux · Debian
9.0; 10.0 · source: NVD
DT
Developer Tools · Redhat
1.0 · source: NVD
EL
Enterprise Linux · Redhat
8.0 · source: NVD
EL
Enterprise Linux Server · Redhat
8.1 · source: NVD
EO
Eos · Arista
through 4.23.1f · source: NVD
FE
Fedora · Fedoraproject
30; 31 · source: NVD
GO
GO · Golang
1.12 before 1.12.11; 1.13 before 1.13.2 · source: NVD
LE
Leap · Opensuse
15.0; 15.1 · source: NVD
MO
Mos · Arista
through 0.25 · source: NVD
TE
Terminattr · Arista
through 1.7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17596
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0101
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0329
Exploit
https://github.com/golang/go/issues/34960
Release Notes
https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ
More from Cloudvision Portal
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
8.8
CVE-2016-9012
CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane, related to a request…
8.1
CVE-2023-24546
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to…
7.8
CVE-2019-18181
In CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for restricted functionality via CVP API calls…
7.5
CVE-2020-13881
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used