GHSA-gv9j-4w24-q7vx

    Dashboard / Vulnerabilities / GHSA-gv9j-4w24-q7vx

    GHSA-gv9j-4w24-q7vx

    Published: 1 Mar 2022Last Modified: 10 Sept 2026
    Aliases:
    GO-2022-0368

    Summary: Improper random number generation in github.com/coredns/coredns

    Details: ### Impact CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries. ### Patches The problem has been fixed in 1.6.6+. ### References - [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794) ### For more information Please consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.

    References: https://github.com/coredns/coredns/security/advisories/GHSA-gv9j-4w24-q7vx, github.com/coredns/coredns

    Affected packages

    Package

    Name: github.com/coredns/coredns

    Purl: pkg:golang/github.com/coredns/coredns

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.6.6

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-gv9j-4w24-q7vx | CVE-DB