Search for vulnerabilities
Vulnerability details: VCID-7tef-cde1-aaap
Vulnerability ID VCID-7tef-cde1-aaap
Aliases CVE-2019-11840
GHSA-r5c5-pr8j-pfp7
Summary An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-330 Use of Insufficiently Random Values
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0079
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11840.json
epss 0.00490 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00490 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00490 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00490 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00689 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00689 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00689 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00689 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00758 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00877 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00877 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00877 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00877 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00877 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00877 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.00877 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02304 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02757 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.02985 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
epss 0.03353 https://api.first.org/data/v1/epss?cve=CVE-2019-11840
cvssv3.1 5.9 https://bugzilla.redhat.com/show_bug.cgi?id=1691529
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=1691529
cvssv3.1 5.3 https://github.com/golang/go
generic_textual MODERATE https://github.com/golang/go
cvssv3.1 5.9 https://github.com/golang/go/issues/30965
generic_textual MODERATE https://github.com/golang/go/issues/30965
cvssv3.1 5.9 https://go.dev/cl/168406
generic_textual MODERATE https://go.dev/cl/168406
cvssv3.1 5.9 https://go.dev/issue/30965
generic_textual MODERATE https://go.dev/issue/30965
cvssv3.1 5.9 https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d
generic_textual MODERATE https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d
cvssv3.1 5.9 https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ
generic_textual MODERATE https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ
cvssv3.1 5.9 https://groups.google.com/g/golang-announce/c/tjyNcJxb2vQ/m/n0NRBziSCAAJ
generic_textual MODERATE https://groups.google.com/g/golang-announce/c/tjyNcJxb2vQ/m/n0NRBziSCAAJ
cvssv3.1 5.9 https://lists.debian.org/debian-lts-announce/2019/06/msg00029.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2019/06/msg00029.html
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
cvssv3.1 5.9 https://lists.debian.org/debian-lts-announce/2020/11/msg00016.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2020/11/msg00016.html
cvssv3.1 5.9 https://lists.debian.org/debian-lts-announce/2020/11/msg00030.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2020/11/msg00030.html
cvssv3.1 5.9 https://lists.debian.org/debian-lts-announce/2021/01/msg00015.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2021/01/msg00015.html
cvssv3.1 5.9 https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2019-11840
cvssv3 5.9 https://nvd.nist.gov/vuln/detail/CVE-2019-11840
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2019-11840
cvssv3.1 5.9 https://pkg.go.dev/vuln/GO-2022-0209
generic_textual MODERATE https://pkg.go.dev/vuln/GO-2022-0209
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11840.json
https://api.first.org/data/v1/epss?cve=CVE-2019-11840
https://bugzilla.redhat.com/show_bug.cgi?id=1691529
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11840
https://github.com/golang/go
https://github.com/golang/go/issues/30965
https://go.dev/cl/168406
https://go.dev/issue/30965
https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d
https://groups.google.com/forum/#%21msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ
https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ
https://groups.google.com/g/golang-announce/c/tjyNcJxb2vQ/m/n0NRBziSCAAJ
https://lists.debian.org/debian-lts-announce/2019/06/msg00029.html
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00016.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/01/msg00015.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
https://pkg.go.dev/vuln/GO-2022-0209
cpe:2.3:a:golang:crypto:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:crypto:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2019-11840 https://nvd.nist.gov/vuln/detail/CVE-2019-11840
RHSA-2021:0079 https://access.redhat.com/errata/RHSA-2021:0079
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11840.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=1691529
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/golang/go
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/golang/go/issues/30965
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://go.dev/cl/168406
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://go.dev/issue/30965
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://groups.google.com/g/golang-announce/c/tjyNcJxb2vQ/m/n0NRBziSCAAJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2019/06/msg00029.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2020/11/msg00016.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2020/11/msg00030.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2021/01/msg00015.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-11840
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-11840
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-11840
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://pkg.go.dev/vuln/GO-2022-0209
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.75861
EPSS Score 0.00490
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.