CVE-2019-11841: debian debian_linux
Vulnerability summary
CVE-2019-11841 is a medium (CVSS 5.9) vulnerability in debian debian_linux. EPSS estimates a 2.00% chance of exploitation in the next 30 days, higher than 80.7% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 22-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
2.00%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.00% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (sec-consult.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard4 products
- dex-k8s-authenticatorAll versions (No fix recorded)
- k3d< 5.6.0-r11
- k3d-proxy< 5.6.0-r11
- k3d-tools< 5.6.0-r11
Wolfi3 products
- k3d< 5.6.0-r11
- k3d-proxy< 5.6.0-r11
- k3d-tools< 5.6.0-r11
Debian2 products
- golang-go.crypto< 1:0.0~git20200221.2aa609c-1 | < 0.0~hg190-1+deb8u2
- debian_linuxEOL8.0 | 9.0
Golang1 product
- crypto2019-03-25
Golang.org/x1 product
- crypto< 0.0.0-20190424203555-c05e17bb3b2d
Ubuntu1 product
- golang-go.cryptoAll versions (No fix recorded)
6 vendors · 12 products
References
19 links- packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.htmlExploitThird Party AdvisoryVDB EntryEVIDENCEWEB
lists.debian.org/debian-lts-announce/2019/09/msg00011.htmlMailing ListThird Party AdvisoryAdvisoryWEB- lists.debian.org/debian-lts-announce/2020/10/msg00014.htmlMailing ListThird Party AdvisoryAdvisoryWEB
- groups.google.com/forum/REPORT
