CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
74.1%
Severity: Medium
Date : 2019-10-21
CVE-ID : CVE-2019-17596
Package : go-pie
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1051
The package go-pie before version 2:1.13.3-1 is vulnerable to denial of
service.
Upgrade to 2:1.13.3-1.
The problem has been fixed upstream in version 1.13.3.
None.
Invalid DSA public keys can cause a panic in dsa.Verify. In particular,
using crypto/x509.Verify on a crafted X.509 certificate chain can lead
to a panic, even if the certificates donβt chain to a trusted root. The
chain can be delivered via a crypto/tls connection to a client, or to a
server that accepts and verifies client certificates. net/http clients
can be made to crash by an HTTPS server, while net/http servers that
accept client certificates will recover the panic and are unaffected.
Moreover, an application might crash invoking
crypto/x509.(*CertificateRequest) CheckSignature on an X.509
certificate request, parsing a golang.org/x/crypto/openpgp Entity, or
during a golang.org/x/crypto/otr conversation. Finally, a
golang.org/x/crypto/ssh client can panic due to a malformed host key,
while a server could panic if either PublicKeyCallback accepts a
malformed public key, or if IsUserAuthority accepts a certificate with
a malformed public key.
A remote attacker can perform a denial of service attack by crafting a
malicious certificate chain.
https://github.com/golang/go/issues/34960
https://security.archlinux.org/CVE-2019-17596
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
74.1%