製品・ソフトウェアに関する情報

JVN脆弱性詳細

Go の crypto/dsa/dsa.go の Verify 関数におけるサービス運用妨害 (DoS) の脆弱性

Title	Go の crypto/dsa/dsa.go の Verify 関数におけるサービス運用妨害 (DoS) の脆弱性
Summary	Go の crypto/dsa/dsa.go の Verify 関数は、big 整数ライブラリに与えるパラメータを適切に確認しないため、サービス運用妨害 (無限ループ) 状態にされる脆弱性が存在します。
Possible impacts	第三者により、HTTPS クライアントの証明書、または SSH サーバライブラリを使用するプログラムの巧妙に細工された公開鍵を介して、サービス運用妨害 (無限ループ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 6, 2016, midnight
Registration Date	May 27, 2016, 3:54 p.m.
Last Update	May 27, 2016, 3:54 p.m.

Affected System

Fedora Project

Fedora 22

Fedora 23

Fedora 24

openSUSE project

openSUSE Leap 42.1

The Go Project

Go 1.5.4 未満

Go 1.6.1 未満の 1.6.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-3959	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3959
National Vulnerability Database (NVD)
2	CVE-2016-3959	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3959

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2016-35d7b09908	https://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html
2	FEDORA-2016-48e72b7bc5	https://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html
3	FEDORA-2016-75063477ca	https://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html
Google Developers
4	Change 21533 - Merged	https://go-review.googlesource.com/#/c/21533/
Google Groups
5	[security] Go 1.6.1 and 1.5.4 are released	https://groups.google.com/forum/#!topic/golang-announce/9eqIHqaWvck
opensuse-updates
6	openSUSE-SU-2016:1331	https://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html

Change Log

No	Changed Details	Date of change
0	[2016年05月27日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-3959

Summary	The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.
Publication Date	May 24, 2016, 4:59 a.m.
Registration Date	Jan. 26, 2021, 2:11 p.m.
Last Update	Nov. 21, 2024, 11:51 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.1:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:golang:go:1.6:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:golang:go::::::::			1.5

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182526.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182526.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183106.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183106.html
5	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183137.html
6	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183137.html
7	http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html
8	http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html
9	http://rhn.redhat.com/errata/RHSA-2016-1538.html
10	http://rhn.redhat.com/errata/RHSA-2016-1538.html
11	http://www.openwall.com/lists/oss-security/2016/04/05/1
12	http://www.openwall.com/lists/oss-security/2016/04/05/1
13	http://www.openwall.com/lists/oss-security/2016/04/05/2
14	http://www.openwall.com/lists/oss-security/2016/04/05/2
15	https://go-review.googlesource.com/#/c/21533/
16	https://go-review.googlesource.com/#/c/21533/
17	https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck
18	https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html