CVE-2019-19794 PUBLISHED

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

EPSS 0.30% · 52.9th percentile

Risk Scores

EPSS Score
0.30%
52.9th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSgolang-github-miekg-dns0, 0.0~git20170501.0.f282f80-2, 0.0~git20170501.0.f282f80-3
Ubuntu:20.04:LTSgolang-github-miekg-dns0, 1.0.4+ds-1ubuntu1

Timeline

References

Open in Interactive Console →