Skip to content
Fencer Intel
medium —

GHSA-gv9j-4w24-q7vx json

Improper random number generation in github.com/coredns/coredns

published 4y ago modified 2mo ago also GO-2022-0368

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

### Patches The problem has been fixed in 1.6.6+.

### References - [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)

### For more information Please consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.

Patch / fix

  • go github.com/coredns/coredns 1.6.6

Is GHSA-gv9j-4w24-q7vx in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/coredns/coredns
<1.6.6
1.6.6

Classification

Weakness
  • CWE-330 Use of Insufficiently Random Values

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.