7.5

CVE-2016-3959

The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensuse ≫ Leap Version 42.1
Golang ≫ Go Version 1.6
Fedoraproject ≫ Fedora Version 22
Fedoraproject ≫ Fedora Version 23
Fedoraproject ≫ Fedora Version 24
Golang ≫ Go Version <= 1.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.42% 0.903
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html
http://www.openwall.com/lists/oss-security/2016/04/05/1
http://www.openwall.com/lists/oss-security/2016/04/05/2
https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182526.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183106.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183137.html
http://rhn.redhat.com/errata/RHSA-2016-1538.html
https://go-review.googlesource.com/#/c/21533/