{"action":"Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later.","affected":[{"introduced":"0"}],"component":"golang.org/x/crypto","cve_ids":["CVE-2019-11841"],"ecosystem":"Go","epss":0.02002,"exploited":false,"fixed_versions":["0.0.0-20190424203555-c05e17bb3b2d"],"ghsa_id":"GHSA-x3jr-pf6g-c48f","id":"tcs_01M5KFRG7TN8C2DW541JN6YQMQ","modified_at":"2026-09-10T03:49:55.084265638Z","published_at":"2022-05-24T16:46:15Z","references":["https://osv.dev/vulnerability/GHSA-x3jr-pf6g-c48f","https://nvd.nist.gov/vuln/detail/CVE-2019-11841","https://github.com/golang/crypto/commit/c05e17bb3b2dca130fc919668a96b4bec9eb9442","https://github.com/golang/crypto/tree/master/openpgp/clearsign","https://go-review.git.corp.google.com/c/crypto/+/173778","https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442","https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ","https://lists.debian.org/debian-lts-announce/2019/09/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html","https://pkg.go.dev/vuln/GO-2023-1992","https://web.archive.org/web/20201207161832/https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841","http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-x3jr-pf6g-c48f","url":"https://osv.dev/vulnerability/GHSA-x3jr-pf6g-c48f"}],"summary":"Golang/x/crypto message forgery vulnerability"}