Description
The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | golang +5 | 1.6.3-1.el7_2.1 | RHSA-2016:1538 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go | 1.7.0-2.1 | openSUSE-SU-2024:10028-1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 | openSUSE-SU-2024:10803-1 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 | openSUSE-SU-2024:10804-1 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 | openSUSE-SU-2024:10805-1 |
| openSUSE Tumbleweed | go1.9 | 1.9.7-11.2 | openSUSE-SU-2024:10812-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
alexmullins/dsa ★ 1 · Apr 10, 2016
Analysis of CVE-2016-3959 and a Proof of Concept Attack Against a Go SSH Server.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.5.4 · >= 1.6.0-0, < 1.6.1 | 1.5.4, 1.6.1 | GO-2022-0166 |
Advisories 6
- RHSA-2016:1538 Red Hat Security Advisory: golang security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · May 13, 2026
- openSUSE-SU-2024:10803-1 go1.10-1.10.8-8.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10812-1 go1.9-1.9.7-11.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10804-1 go1.11-1.11.13-10.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10028-1 go-1.7.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10805-1 go1.12-1.12.17-4.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20160405 Re: CVE request - Go - DLL loading, Big int mailing-list
- https://go-review.googlesource.com/#/c/21533/
- RHSA-2016:1538 vendor-advisory
- FEDORA-2016-2940ad5550 vendor-advisory
- [golang-announce] 20160412 [security] Go 1.6.1 and 1.5.4 are released mailing-list
- FEDORA-2016-59c5e405e3 vendor-advisory
- openSUSE-SU-2016:1331 vendor-advisory
- [oss-security] 20160405 CVE request - Go - DLL loading, Big int mailing-list
- FEDORA-2016-2fcfc7670f vendor-advisory