Search for vulnerabilities
Vulnerability details: VCID-hpvr-81mr-aaaq
Vulnerability ID VCID-hpvr-81mr-aaaq
Aliases CVE-2019-11841
GHSA-x3jr-pf6g-c48f
Summary A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-347 Improper Verification of Cryptographic Signature
System Score Found at
cvssv3.1 5.9 http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html
generic_textual MODERATE http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0051 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0051 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0051 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0051 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.0051 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00782 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.00874 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.01007 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.01007 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.01007 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.01007 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.01007 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.01007 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.01007 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.02286 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.02286 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.02286 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
epss 0.02286 https://api.first.org/data/v1/epss?cve=CVE-2019-11841
cvssv3.1 5.9 https://github.com/golang/crypto/commit/c05e17bb3b2dca130fc919668a96b4bec9eb9442
generic_textual MODERATE https://github.com/golang/crypto/commit/c05e17bb3b2dca130fc919668a96b4bec9eb9442
cvssv3.1 5.9 https://github.com/golang/crypto/tree/master/openpgp/clearsign
generic_textual MODERATE https://github.com/golang/crypto/tree/master/openpgp/clearsign
cvssv3.1 5.9 https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442
generic_textual MODERATE https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442
cvssv3.1 5.9 https://go-review.git.corp.google.com/c/crypto/+/173778
generic_textual MODERATE https://go-review.git.corp.google.com/c/crypto/+/173778
cvssv3.1 5.9 https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ
generic_textual MODERATE https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ
cvssv3.1 5.9 https://lists.debian.org/debian-lts-announce/2019/09/msg00011.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2019/09/msg00011.html
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
cvssv3.1 5.9 https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2019-11841
cvssv3 5.9 https://nvd.nist.gov/vuln/detail/CVE-2019-11841
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2019-11841
cvssv3.1 5.9 https://pkg.go.dev/vuln/GO-2023-1992
generic_textual MODERATE https://pkg.go.dev/vuln/GO-2023-1992
cvssv3.1 5.9 https://web.archive.org/web/20201207161832/https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841
generic_textual MODERATE https://web.archive.org/web/20201207161832/https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841
Reference id Reference type URL
http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html
https://api.first.org/data/v1/epss?cve=CVE-2019-11841
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11841
https://github.com/golang/crypto/commit/c05e17bb3b2dca130fc919668a96b4bec9eb9442
https://github.com/golang/crypto/tree/master/openpgp/clearsign
https://go.googlesource.com/crypto/
https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442
https://go-review.git.corp.google.com/c/crypto/+/173778
https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ
https://lists.debian.org/debian-lts-announce/2019/09/msg00011.html
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
https://pkg.go.dev/vuln/GO-2023-1992
https://sec-consult.com/
https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841/
https://web.archive.org/web/20201207161832/https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841
cpe:2.3:a:golang:crypto:2019-03-25:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:crypto:2019-03-25:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2019-11841 https://nvd.nist.gov/vuln/detail/CVE-2019-11841
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/golang/crypto/commit/c05e17bb3b2dca130fc919668a96b4bec9eb9442
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/golang/crypto/tree/master/openpgp/clearsign
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://go-review.git.corp.google.com/c/crypto/+/173778
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2019/09/msg00011.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-11841
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-11841
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-11841
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://pkg.go.dev/vuln/GO-2023-1992
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://web.archive.org/web/20201207161832/https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.59147
EPSS Score 0.0039
Published At May 19, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.