—

GO-2020-0008

Insecure generation of random numbers in github.com/miekg/dns

Quick fix

GO-2020-0008 — github.com/miekg/dns: upgrade to the fixed version with the command below.

go get github.com/miekg/dns@v1.1.25-0.20191211073109-8ebf2e419df7

Details

DNS message transaction IDs are generated using math/rand which makes them relatively predictable. This reduces the complexity of response spoofing attacks against DNS clients.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/miekg/dns

Introduced in: 0Fixed in: 1.1.25-0.20191211073109-8ebf2e419df7

Fixgo get github.com/miekg/dns@v1.1.25-0.20191211073109-8ebf2e419df7

References

https://github.com/miekg/dns/pull/1044[FIX]
https://github.com/miekg/dns/commit/8ebf2e419df7857ac8919baa05248789a8ffbf33[FIX]
https://github.com/miekg/dns/issues/1037[WEB]
https://github.com/miekg/dns/issues/1043[WEB]