data/osv/GO-2022-0166.json

{
  "id": "GO-2022-0166",
  "published": "2022-05-24T22:06:33Z",
  "modified": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2016-3959"
  ],
  "details": "The Verify function in crypto/dsa passed certain parameters unchecked to\nthe underlying big integer library, possibly leading to extremely\nlong-running computations, which in turn makes Go programs vulnerable to\nremote denial of service attacks.  Programs using HTTPS client certificates\nor the Go SSH server libraries are both exposed to this vulnerability.\n",
  "affected": [
    {
      "package": {
        "name": "stdlib",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.4"
            },
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.1"
            }
          ]
        }
      ],
      "database_specific": {
        "url": "https://pkg.go.dev/vuln/GO-2022-0166"
      },
      "ecosystem_specific": {
        "imports": [
          {
            "path": "crypto/dsa",
            "symbols": [
              "Verify"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "FIX",
      "url": "https://go.dev/cl/21533"
    },
    {
      "type": "FIX",
      "url": "https://go.googlesource.com/go/+/eb876dd83cb8413335d64e50aae5d38337d1ebb4"
    },
    {
      "type": "REPORT",
      "url": "https://go.dev/issue/15184"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/9eqIHqaWvck"
    }
  ]
}