CVE-2016-3959 Denial of service due to unchecked parameters in crypto/dsa
HighCVSS 7.5
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stdlib(Go) | < 1.5.4 | 1.5.4 |
| stdlib(Go) | >= 1.6.0-0, < 1.6.1 | 1.6.1 |
| openSUSE leap | = 42.1 | No fix listed |
| golang go | = 1.6 | No fix listed |
| golang go | <= 1.5 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
References
- go.dev patch
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- FEDORA-2016-2940ad5550 vendor-advisory
- FEDORA-2016-59c5e405e3 vendor-advisory
- FEDORA-2016-2fcfc7670f vendor-advisory
- openSUSE-SU-2016:1331 vendor-advisory
- RHSA-2016:1538 vendor-advisory
- [oss-security] 20160405 CVE request - Go - DLL loading, Big int mailing-list
- [oss-security] 20160405 Re: CVE request - Go - DLL loading, Big int mailing-list
- go-review.googlesource.com
- [golang-announce] 20160412 [security] Go 1.6.1 and 1.5.4 are released mailing-list