PT-2016-5779 · Google+3 · Go+3

Jason Buberel · Published 2015-09-28 · Updated 2024-06-15 · CVE-2016-3959

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.5.4 Go versions 1.6.x prior to 1.6.1

Description The issue arises from the Verify function in crypto/dsa/dsa.go not properly checking parameters passed to the big integer library. This could allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries. The vulnerability exposes programs using HTTPS client certificates or the Go SSH server libraries to remote denial of service attacks due to potentially extremely long-running computations.

Recommendations For Go versions prior to 1.5.4, update to version 1.5.4 or later. For Go versions 1.6.x prior to 1.6.1, update to version 1.6.1 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1812

ALT-PU-2016-1849

AZL-79052

CESA-2016_1538

CVE-2016-3959

GO-2022-0166

MGASA-2016-0207

OPENSUSE-SU-2024:10028-1

OPENSUSE-SU-2024:10803-1

OPENSUSE-SU-2024:10804-1

OPENSUSE-SU-2024:10805-1

OPENSUSE-SU-2024:10812-1

RHSA-2016:1538

RHSA-2016_1538

Affected Products

Alt Linux

Centos

Go

Red Hat

References · 50

• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182526.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0207 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10805-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3959 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183137.html · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0166 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183106.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3959 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10812-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3959 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-3959 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10028-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3959 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10803-1 · Vendor Advisory