Search/CVE-2019-17596
● CVE — High

CVE-2019-17596

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

View graph Watch Export
CVSS v3.1
7.5 HIGH
EPSS
4.69%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Connections
12 relationships
Timeline
disclosure → media coverage
Oct 24, 2019
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024
Public PoC (1)
github.com/pquerna/poc-dsa-verify-CVE-2019-17596
Unverified third-party code — review before executing.