CVE-2019-19794 @ Go-github.com/miekg/dns-v1.0.14

[Yoavast]

Vulnerable Package issue exists @ Go-github.com/miekg/dns-v1.0.14 in branch main

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

Namespace: Yoavast
Repository: CX-AST
Repository Url: https://github.com/Yoavast/CX-AST
CxAST-Project: Yoavast/CX-AST
CxAST platform scan: f4e2badb-d784-4b21-beea-d2a1a654b646
Branch: main
Application: CX-AST
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-338

---

Additional Info
Attack vector: NETWORK
Attack complexity: HIGH
Confidentiality impact: NONE
Availability impact: NONE
Remediation Upgrade Recommendation: v1.0.14-0.20181012211526-4a9ca7e98d0f

---

References
Advisory
Advisory
Issue
Pull request
Commit