CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2019-17596
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
Severity
- EPSS
- 4.7% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-436
- Published
- Modified
- Record from
- the NVD, synced
Affected
- arista:cloudvision_portal
- arista:eos
- arista:mos
- arista:terminattr
- debian:debian_linux
- fedoraproject:fedora
- golang:go
- opensuse:leap
- redhat:developer_tools
- redhat:enterprise_linux
- redhat:enterprise_linux_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GO-2022-0213 | Go | stdlib | <1.12.11 >=1.13.0-0 <1.13.2 | 1.12.11, 1.13.2 |