miekg vulnerabilities

Products

• github.com/miekg/dns 3

Latest miekg CVEs

Newest publication first

1. CVE-2019-19794 miekg/dns insecurely generates random numbers

   Published 2019-12-13

   Medium·CVSS 5.9 EPSS 2.1%

   The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

2. CVE-2018-17419 miekg/dns parsing error leads to nil pointer dereference and DoS

   Published 2019-03-07

   High·CVSS 7.5 EPSS 1.8%

   An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.

3. CVE-2017-15133 Denial of Service in miekg-dns

   Published 2018-01-29

   High·CVSS 7.5 EPSS 1.9%

   A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.