What is GHSA-44r7-7p62-q3fr?

GHSA-44r7-7p62-q3fr is a security advisory published by GitHub Security Advisories with Medium severity. miekg/dns insecurely generates random numbers

Which CVE IDs does GHSA-44r7-7p62-q3fr cover?

GHSA-44r7-7p62-q3fr covers the following CVE IDs: CVE-2019-19794. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-44r7-7p62-q3fr?

GHSA-44r7-7p62-q3fr has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-44r7-7p62-q3fr?

GHSA-44r7-7p62-q3fr affects 1 product, including: go/github.com/miekg/dns:\u003c 1.1.25.

GHSA-44r7-7p62-q3frMediumCVSS 5.9

miekg/dns insecurely generates random numbers

Vendor

GitHub Security Advisories

Published

May 18, 2021

Last Modified

August 29, 2023

🔗 CVE IDs covered (1)

CVE-2019-19794 →

📋 Description

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

🎯 Affected products1

go/github.com/miekg/dns:< 1.1.25

🔗 References (10)

https://nvd.nist.gov/vuln/detail/CVE-2019-19794
https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044
https://github.com/miekg/dns/commit/8ebf2e419df7857ac8919baa05248789a8ffbf33
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1037
https://pkg.go.dev/vuln/GO-2020-0008
https://github.com/advisories/GHSA-44r7-7p62-q3fr