CVE-2016-3959

2016-05-2300:00:00

ubuntu.com

0.027 Low

EPSS

Percentile

90.5%

JSON

The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x
before 1.6.1 does not properly check parameters passed to the big integer
library, which might allow remote attackers to cause a denial of service
(infinite loop) via a crafted public key to a program that uses HTTPS
client certificates or SSH server libraries.

Notes

Author	Note
mdeslaur	Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays.