Skip to content
OpenAdvisories
High ALAS2-2024-2545 1 CVE

Important: golang security update (Amazon Linux 2)

Published May 9, 2024 · Updated Sep 23, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17596: Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 golang 0:1.13.4-1.amzn2.0.1
Amazon Linux · 2 golang-bin 0:1.13.4-1.amzn2.0.1
Amazon Linux · 2 golang-docs 0:1.13.4-1.amzn2.0.1
Amazon Linux · 2 golang-misc 0:1.13.4-1.amzn2.0.1
Amazon Linux · 2 golang-race 0:1.13.4-1.amzn2.0.1
Amazon Linux · 2 golang-src 0:1.13.4-1.amzn2.0.1
Amazon Linux · 2 golang-tests 0:1.13.4-1.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2019-17596 Public exploit

    Panic on invalid DSA public keys in crypto/dsa

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

    golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-17596.html