Resource exhaustion in Go programming language - CVE-2019-6486

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17245

Resource exhaustion in Go programming language - CVE-2019-6486

Published: January 24, 2019 / Updated: January 28, 2019


Vulnerability identifier: #VU17245
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-6486
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves due to insufficient validation of user-supplied input. A remote attacker can submit specially crafted inputs via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures, consume excessive amounts of CPU and cause the service to crash.


Affected software

Go programming language
Arch Linux
Amazon Linux AMI
Fedora
Opensuse
SUSE Linux
golang-1.7 (Debian package)
golang-1.8 (Debian package)
go (Alpine package)
golang

How to mitigate CVE-2019-6486

Install update from vendor's website.

golang-1.7 (Debian package) - update to 1.7.4-2+deb9u1
golang-1.8 (Debian package) - update to 1.8.1-1+deb9u1
go (Alpine package) - addressed in versions 1.10.8-r0, 1.11.5-r0
golang - addressed in versions 1.10.8-1.fc28, 1.11.5-1.el6, 1.11.5-1.el7, 1.11.5-1.fc29

External References

Related Security Bulletins