CVE-2019-19794: Insecure generation of random numbers in github.com/miekg/dns
Summary
CVE-2019-19794: miekg/dns insecurely generates random numbers. Affects github.com/miekg/dns versions < 1.1.25. Fixed in 1.1.25. How to fix ↓
Also tracked for
- golang-github-miekg-dns · Debian:11
The same CVE-2019-19794 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/miekg/dns package is a Go DNS package that is used in various products, including CoreDNS. It provides functionality for DNS message parsing, generation, and handling. The package is vulnerable to an insecure generation of random numbers due to the use of math/rand. This vulnerability affects versions before 1.1.25 of the package.
Vulnerability Detail
The insecure generation of random numbers in the github.com/miekg/dns package leads to predictability of the Transaction ID (TXID) used in DNS requests. This predictability allows attackers to forge responses, potentially leading to DNS cache poisoning or other types of DNS-related attacks. The vulnerability has a CVSSv3 score of 5.9, indicating a moderate severity.
How To Fix
Minimum fixed version
1.1.25
This is the first release that contains the fix.
go get github.com/miekg/dns@v1.1.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the package to the fixed version.
Conclusion
The github.com/miekg/dns package before version 1.1.25 is vulnerable to an insecure generation of random numbers, which can lead to response forgeries in DNS. It is recommended to update the package to version 1.1.25 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/miekg/dns →
FAQ
The vulnerability allows attackers to forge DNS responses, potentially leading to DNS cache poisoning or other DNS-related attacks.
Versions before 1.1.25 of the github.com/miekg/dns package are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Gopkg.lock file without requiring any signup or installation.
Yes, the CVSSv3 score for this vulnerability is 5.9, indicating a moderate severity.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-44r7-7p62-q3fr/GHSA-44r7-7p62-q3fr.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/miekg/dns.
