CVE-2019-17596
golang-1.11 - security update
描述
Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key.
如何修補 CVE-2019-17596
要修補 CVE-2019-17596,請將受影響套件升級到下列已修補版本。
- —升級至 1.11.6-1+deb10u3 或更新版本
- —升級至 1.12.11 或更新版本
CVE-2019-17596 正在被利用嗎?
低 — EPSS 為 4.7%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 1.11.6-1+deb10u3
- from 0, < 1.12.11, >= 1.13.0-0, < 1.13.2