NVD

Id
19695  
Name
CVE-2016-3959  
Description
The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2016-05-23  
Modified Date
2016-05-25  
Seq
2016-3959  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
107920 19695 CVE-2016-3959 FEDORA-2016-2940ad5550  View
107921 19695 CVE-2016-3959 FEDORA-2016-59c5e405e3  View
107922 19695 CVE-2016-3959 FEDORA-2016-2fcfc7670f  View
107923 19695 CVE-2016-3959 openSUSE-SU-2016:1331  View
107924 19695 CVE-2016-3959 [oss-security] 20160405 CVE request - Go - DLL loading, Big int  View
107925 19695 CVE-2016-3959 [oss-security] 20160405 Re: CVE request - Go - DLL loading, Big int  View
107926 19695 CVE-2016-3959 https://go-review.googlesource.com/#/c/21533/  View
107927 19695 CVE-2016-3959 [golang-announce] 20160412 [security] Go 1.6.1 and 1.5.4 are released  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2139 JVNDB-2016-002912 Go の crypto/dsa/dsa.go の Verify 関数におけるサービス運用妨害 (DoS) の脆弱性 Go の crypto/dsa/dsa.go の Verify 関数は、big 整数ライブラリに与えるパラメータを適切に確認しないため、サービス運用妨害 (無限ループ) 状態にされる脆弱性が存在します。 CVE-2016-3959 90465 CVE-2016-3959 19695 5 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002912.html 2016-04-06 2016-05-27 View