What is GHSA-gv9j-4w24-q7vx?

GHSA-gv9j-4w24-q7vx is a security advisory published by GitHub Security Advisories with Medium severity. Improper random number generation in github.com/coredns/coredns

Why does GHSA-gv9j-4w24-q7vx have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-gv9j-4w24-q7vx?

GHSA-gv9j-4w24-q7vx affects 1 product, including: go/github.com/coredns/coredns:\u003c 1.6.6.

GHSA-gv9j-4w24-q7vxMediumDisclosed before NVD

Improper random number generation in github.com/coredns/coredns

Vendor

GitHub Security Advisories

Published

March 1, 2022

Last Modified

January 11, 2023

📋 Description

Impact

CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

Patches

The problem has been fixed in 1.6.6+.

References

CVE-2019-19794

For more information

Please consult our security guide for more information regarding our security process.

🎯 Affected products1

go/github.com/coredns/coredns:< 1.6.6

🔗 References (2)

https://github.com/coredns/coredns/security/advisories/GHSA-gv9j-4w24-q7vx
https://github.com/advisories/GHSA-gv9j-4w24-q7vx