CVE-2019-9634.json

{
  "schema_version": "1.6.3",
  "id": "CVE-2019-9634",
  "modified": "2024-05-20T16:03:47Z",
  "published": "2022-05-25T18:01:46Z",
  "aliases": [
    "GO-2022-0220"
  ],
  "related": [],
  "summary": "DLL injection on Windows in runtime and syscall. Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Go, hasta su versión 1.12 en Windows, utiliza de manera incorrecta determinadas funcionalidades de LoadLibrary, conduciendo a una inyección DLL",
  "details": "Go on Windows misused certain LoadLibrary functionality, leading to DLL injection",
  "severity": [
    {
      "type": "CVSS_V2",
      "score": "6.8"
    },
    {
      "type": "CVSS_V3",
      "score": "7.8"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "stdlib"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.10"
            },
            {
              "introduced": "1.12.0-0"
            },
            {
              "fixed": "1.12.2"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "runtime",
            "goos": [
              "windows"
            ]
          },
          {
            "path": "syscall",
            "goos": [
              "windows"
            ],
            "symbols": [
              "LoadDLL"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "FIX",
      "url": "https://go.dev/cl/165798"
    },
    {
      "type": "FIX",
      "url": "https://go.googlesource.com/go/+/9b6e9f0c8c66355c0f0575d808b32f52c8c6d21c"
    },
    {
      "type": "REPORT",
      "url": "https://go.dev/issue/28978"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/z9eTD34GEIs/m/Z_XmhTrVAwAJ"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/04/09/1"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107450"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang/go/issues/30642"
    }
  ],
  "credits": [
    {
      "name": "Samuel Cochran"
    },
    {
      "name": "Jason Donenfeld"
    }
  ],
  "database_specific": {
    "metrics": {
      "cvssMetricV31": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "attackVector": "LOCAL",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      ],
      "cvssMetricV2": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "2.0",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authentication": "NONE",
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8
          },
          "baseSeverity": "MEDIUM",
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "acInsufInfo": false,
          "obtainAllPrivilege": false,
          "obtainUserPrivilege": false,
          "obtainOtherPrivilege": false,
          "userInteractionRequired": true
        }
      ]
    },
    "cwe_details": [
      {
        "cwe_id": "CWE-427",
        "name": "Primary",
        "description": "",
        "source": "nvd@nist.gov",
        "url": ""
      }
    ],
    "repositories": [],
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4F672385-FA65-4B3D-A938-A3C3A58B9725",
            "versionEndExcluding": "1.11.10"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7095D7D2-AFC1-4ACA-A92B-56C06C398F44",
            "versionStartIncluding": "1.12",
            "versionEndExcluding": "1.12.2"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": false,
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ]
      }
    ],
    "vulndb_data": {
      "url": "https://pkg.go.dev/vuln/GO-2022-0220",
      "review_status": "REVIEWED"
    },
    "datasources": {
      "govuln": true,
      "nvd": true,
      "cvefixes": false
    }
  }
}