PT-2019-12524 · Go · Go Cryptography Libraries

Published 2019-05-22 · Updated 2023-08-23 · CVE-2019-11841

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions supplementary Go cryptography libraries (affected versions not specified)

Description A message-forgery issue was discovered in the supplementary Go cryptography libraries. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers, which specify the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, allowing an attacker to spoof it. This enables an attacker to lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Furthermore, the library's skipping of Armor Header parsing allows an attacker to embed arbitrary Armor Headers and prepend arbitrary text to cleartext messages without invalidating the signatures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2019-11841

DLA-1920-1

DLA-2402-1

DLA-3455-1

GHSA-X3JR-PF6G-C48F

GO-2023-1992

Affected Products

Go Cryptography Libraries

References · 27

• 🔥 https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841 · Exploit
• 🔥 http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2019-11841 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3jr-pf6g-c48f · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1920-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11841 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11841 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11841 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11841 · Security Note
• https://osv.dev/vulnerability/GO-2023-1992 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2402-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3455-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11841 · Vendor Advisory
• https://github.com/golang/crypto/tree/master/openpgp/clearsign · Note