Stay Secure with the Latest Linux Advisories

security advisorydenial of servicesecurity issue

Debian: 202209-45 Severity: Critical Remote Code Execution

The package go before version 2:1.13.3-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-201910-12 ========================================= Severity: Medium Date : 2019-10-21 CVE-ID : CVE-2019-17596 Package : go Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1051 Summary ====== The package go before version 2:1.13.3-1 is vulnerable to denial of service. Resolution ========= Upgrade to 2:1.13.3-1. # pacman -Syu "go> =2:1.13.3-1" The problem has been fixed upstream in version 1.13.3. Workaround ========= None. Description ========== Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don’t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Moreover, an application might crash invoking crypto/x509.(*CertificateRequest) CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key. Impact ===== A remote attacker can perform a denial of service attack by crafting a malicious certificate chain. References ========= https://github.com/golang/go/issues/34960 https://security.archlinux.org/CVE-2019-17596 . Security notice issued for Arch Linux regarding vulnerability in go package, posing risk of denial of service; comprehensive resolution details included.. ArchLinux Security Advisory,package go, denial of service, medium severity. . Severity: Medium. LinuxSecurity.com Team

Oct 23, 2019 •Medium ArchLinux