CVE-2019-19794

Published: Dic 13, 2019 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2021-0929 Aliases: GHSA-44r7-7p62-q3fr
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none
MEDIUM 4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: partial
Availability: none

Description

AI Translation Available

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0030
Percentile
0,5th
Updated

EPSS Score Trend (Last 90 Days)

338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
Application

Miekg-Dns by Miekg-Dns Project

Product Information
Vendor Miekg-Dns Project
Product Miekg-Dns
Version Range Affected
To 1.1.25 (exclusive)
cpe:2.3:a:miekg-dns_project:miekg-dns:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/coredns/coredns/issues/3519
Issue Tracking Third Party Advisory
https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
Third Party Advisory
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
Release Notes Third Party Advisory
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1043
Exploit Issue Tracking Third Party Advisory
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044
Patch Third Party Advisory
https://github.com/miekg/dns/pull/1044
https://github.com/coredns/coredns/issues/3519
Issue Tracking Third Party Advisory
https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
Third Party Advisory
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
Release Notes Third Party Advisory
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1043
Exploit Issue Tracking Third Party Advisory
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044
Patch Third Party Advisory
https://github.com/miekg/dns/pull/1044