GO-2023-1992
Misleading message verification in golang.org/x/crypto/openpgp/clearsign
At a glance
- Published
- Updated
- CVE
- CVE-2019-11841
- Aliases
- GHSA-x3jr-pf6g-c48f
Description
The clearsign package accepts some malformed messages, making it possible for an attacker to trick a human user (but not a Go program) into thinking unverified text is part of the message. With fix, messages with malformed headers in the SIGNED MESSAGE section are rejected.
Affected packages
| Package | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.0.0-20190424203555-c05e17bb3b2d |
References
- https://go-review.git.corp.google.com/c/crypto/+/173778 FIX
- https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442 FIX
- https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |