PT-2019-15962 · Coredns+1 · Coredns+1

Cx-Tatianab + 2 · Published 2019-12-13 · Updated 2021-05-18 · CVE-2019-19794

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions miekg Go DNS package versions prior to 1.1.25 CoreDNS versions prior to 1.6.6

Description The issue arises from the improper generation of random numbers due to the use of math/rand, making DNS message transaction IDs predictable. This predictability reduces the complexity of response spoofing attacks against DNS clients.

Recommendations For miekg Go DNS package versions prior to 1.1.25, update to version 1.1.25 or later to resolve the issue. For CoreDNS versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-338

CWE-330

Related Identifiers

CVE-2019-19794

GHSA-44R7-7P62-Q3FR

GO-2020-0008

Affected Products

Coredns

Miekg Go Dns

References · 17

• 🔥 https://github.com/miekg/dns/issues/1043 · Exploit
• https://github.com/miekg/dns/pull/1044 · Patch
• https://security-tracker.debian.org/tracker/CVE-2019-19794 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19794 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-44r7-7p62-q3fr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19794 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19794 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2020-0008 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19794 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19794 · Security Note
• https://github.com/coredns/coredns/issues/3519 · Note
• https://github.com/coredns/coredns/issues/3547 · Note
• https://github.com/miekg/dns/compare/v1.1.24...v1.1.25 · Note
• https://github.com/miekg/dns/issues/1037 · Note