CVE-2019-6486 Denial of service in n/a
Attackers can cause CPU exhaustion or recover private keys via mishandled elliptic curves in the Go standard library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-6486?
CVE-2019-6486 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 24 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
Weakness: CWE-770
Which versions are affected by CVE-2019-6486?
1 open source package ship an affected version, including stdlib. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
stdlib Go | All versions | 1.10.8, 1.11.5 |
Linux distribution packages (1)
go1.11 openSUSE:Leap 15.0 | All versions | 1.11.5-lp150.6.4 |
Products include Debian Debian Linux, Golang Go, Opensuse Leap.
How do I fix CVE-2019-6486?
Upgrade stdlib to a fixed version for your release line: 1.10.8 or 1.11.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-6486 being exploited?
There is no known exploitation of CVE-2019-6486 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-79018, AZL-98958, DLA-1664-1, GHSA-vj2x-6gjj-jvh2, GO-2022-0217, SUSE-SU-2019:0651-1 and 3 more.