CVE-2019-17596 Denial of service in n/a

High 7.5 Published 24 Oct 2019 Updated 5 Aug 2024

An attacker can cause a denial of service by sending invalid DSA public keys in network traffic to Go applications verifying client certificates.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-17596?

CVE-2019-17596 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 24 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Weakness: CWE-436

Which versions are affected by CVE-2019-17596?

1 open source package ship an affected version, including stdlib. It affects 11 products.

Package	Affected	Fixed in
`stdlib` Go	All versions	`1.12.11, 1.13.2`

Products include Arista Cloudvision Portal, Arista Eos, Arista Mos, Arista Terminattr, Debian Debian Linux, Fedoraproject Fedora and 5 more.

How do I fix CVE-2019-17596?

Upgrade stdlib to a fixed version for your release line: 1.12.11 or 1.13.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-17596 being exploited?

There is no known exploitation of CVE-2019-17596 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-79090, AZL-98898, CLEANSTART-2025-KH04903, DSA-4551-1, GHSA-gcr4-wcqh-3624, GO-2022-0213 and 2 more.