| Vulnerability Name: | CVE-2019-11840 (CCN-160943) | ||||||||||||||||||||
| Assigned: | 2019-05-09 | ||||||||||||||||||||
| Published: | 2019-05-09 | ||||||||||||||||||||
| Updated: | 2023-06-17 | ||||||||||||||||||||
| Summary: | Golang golang-googlecode-go-crypto could allow a remote attacker to obtain sensitive information, caused by a flaw in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. By generating a specially-crafted keystream, an attacker could exploit this vulnerability to obtain sensitive information. | ||||||||||||||||||||
| CVSS v3 Severity: | 5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) 5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
| ||||||||||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2019-11840 Source: CCN Type: Red Hat Bugzilla Bug 1691529 golang-googlecode-go-crypto: Keystream loop in amd64 assembly when overflowing 32-bit counter Source: cve@mitre.org Type: Issue Tracking, Vendor Advisory cve@mitre.org Source: XF Type: UNKNOWN golang-cve201911840-info-disc(160943) Source: CCN Type: go GIT Repsitory x/crypto/salsa20: keystream loop in amd64 implementation after 256GiB #30965 Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Patch, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: UNKNOWN cve@mitre.org Source: CCN Type: IBM Security Bulletin 6599703 (Db2 On Openshift) Multiple vulnerabilities affect IBM Db2 On Openshift and IBM Db2 and Db2 Warehouse on Cloud Pak for Data Source: CCN Type: WhiteSource Vulnerability Database CVE-2019-11840 | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||