PT-2016-5779 · Google+3 · Go+3

Jason Buberel · Publicado 2015-09-28 · Atualizado 2024-06-15 · CVE-2016-3959

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.5.4 Go versions 1.6.x prior to 1.6.1

Description The issue arises from the Verify function in crypto/dsa/dsa.go not properly checking parameters passed to the big integer library. This could allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries. The vulnerability exposes programs using HTTPS client certificates or the Go SSH server libraries to remote denial of service attacks due to potentially extremely long-running computations.

Recommendations For Go versions prior to 1.5.4, update to version 1.5.4 or later. For Go versions 1.6.x prior to 1.6.1, update to version 1.6.1 or later.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2015-1812

ALT-PU-2016-1849

AZL-79052

CESA-2016_1538

CVE-2016-3959

GO-2022-0166

MGASA-2016-0207

OPENSUSE-SU-2024:10028-1

OPENSUSE-SU-2024:10803-1

OPENSUSE-SU-2024:10804-1

OPENSUSE-SU-2024:10805-1

OPENSUSE-SU-2024:10812-1

RHSA-2016:1538

RHSA-2016_1538

Produtos afetados

Alt Linux

Centos

Go

Red Hat

Referências · 50

• https://groups.google.com/g/golang-announce/c/9eqIHqaWvck · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182526.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2016-0207 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10805-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-16276 · Nota
• https://suse.com/security/cve/CVE-2017-15041 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-3959 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183137.html · Aviso do Fabricante
• https://go.dev/cl/21533 · Nota
• https://osv.dev/vulnerability/GO-2022-0166 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183106.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-3959 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10812-1 · Aviso do Fabricante