GO-2023-1992
Misleading message verification in golang.org/x/crypto/openpgp/clearsign
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-11841
- Alias
- GHSA-x3jr-pf6g-c48f
Description
The clearsign package accepts some malformed messages, making it possible for an attacker to trick a human user (but not a Go program) into thinking unverified text is part of the message. With fix, messages with malformed headers in the SIGNED MESSAGE section are rejected.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.0.0-20190424203555-c05e17bb3b2d |
Références
- https://go-review.git.corp.google.com/c/crypto/+/173778 FIX
- https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442 FIX
- https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |