Vulnerability Report: GO-2020-0008
- CVE-2019-19794, GHSA-44r7-7p62-q3fr
- Affects: github.com/miekg/dns
- Published: Apr 14, 2021
- Modified: Jun 12, 2023
DNS message transaction IDs are generated using math/rand which makes them relatively predictable. This reduces the complexity of response spoofing attacks against DNS clients.
Affected Packages
-
PathVersionsSymbols
-
before v1.1.25-0.20191211073109-8ebf2e419df7
5 affected symbols
Aliases
References
- https://github.com/miekg/dns/pull/1044
- https://github.com/miekg/dns/commit/8ebf2e419df7857ac8919baa05248789a8ffbf33
- https://github.com/miekg/dns/issues/1037
- https://github.com/miekg/dns/issues/1043
- https://vuln.go.dev/ID/GO-2020-0008.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.