PT-2019-15962 · Coredns+1 · Coredns+1

Cx-Tatianab + 2 · Publicado 2019-12-13 · Atualizado 2021-05-18 · CVE-2019-19794

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions miekg Go DNS package versions prior to 1.1.25 CoreDNS versions prior to 1.6.6

Description The issue arises from the improper generation of random numbers due to the use of math/rand, making DNS message transaction IDs predictable. This predictability reduces the complexity of response spoofing attacks against DNS clients.

Recommendations For miekg Go DNS package versions prior to 1.1.25, update to version 1.1.25 or later to resolve the issue. For CoreDNS versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-338

CWE-330

Identificadores relacionados

CVE-2019-19794

GHSA-44R7-7P62-Q3FR

GO-2020-0008

Produtos afetados

Coredns

Miekg Go Dns

Referências · 17

• 🔥 https://github.com/miekg/dns/issues/1043 · Exploit
• https://github.com/coredns/coredns/issues/3519 · Nota
• https://github.com/coredns/coredns/issues/3547 · Nota
• https://github.com/miekg/dns/pull/1044 · Correção
• https://github.com/miekg/dns/compare/v1.1.24...v1.1.25 · Nota
• https://github.com/miekg/dns/issues/1037 · Nota
• https://github.com/miekg/dns/commit/8ebf2e419df7857ac8919baa05248789a8ffbf33 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-19794 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-19794 · Aviso do Fabricante
• https://pkg.go.dev/vuln/GO-2020-0008 · Nota
• https://ubuntu.com/security/CVE-2019-19794 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-44r7-7p62-q3fr · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19794 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19794 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2020-0008 · Aviso do Fabricante