VDB
CVE-2019-11840
CVE-2019-11840
PUBLISHED
An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.
EPSS 2.14% · 84.6th percentile
Risk Scores
EPSS Score
2.14%
84.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:16.04:LTS | golang-go.crypto | 0, 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1, 1:0.0~git20151201.0.7b85b09-2 |
| Cloudflare | stream | |
| Ubuntu:Pro:18.04:LTS | golang-go.crypto | 1:0.0~git20170629.0.5ef0053-1ubuntu1, *, 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1 |
| Ubuntu:22.04:LTS | snapd | 2.63+22.04ubuntu0.1, 2.63+22.04, 2.55.5+22.04 |
| Ubuntu:24.04:LTS | snapd | 2.63.1+24.04, 2.60.4+23.10, 2.62+24.04build1 |
| Ubuntu:Pro:16.04:LTS | snapd | 2.54.3+16.04~esm2, 2.22.3, 2.48 |
| Ubuntu:20.04:LTS | snapd | 2.45.1+20.04.2, 0, 2.41+19.10.1 |
| Ubuntu:25.10 | snapd | 2.72+ubuntu25.10.2, 2.73+ubuntu25.10, 2.71.1+ubuntu25.10.1 |
| Ubuntu:Pro:18.04:LTS | snapd | 2.31.1+18.04, 2.32+18.04~pre5, 2.32+18.04~pre6 |
Timeline
- May 9, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-11840 third-party-advisory
- https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d third-party-advisory
- https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-11840 third-party-advisory