{"action":"Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later.","affected":[{"introduced":"0"}],"component":"golang.org/x/crypto","cve_ids":["CVE-2019-11841"],"ecosystem":"Go","epss":0.02002,"exploited":false,"fixed_versions":["0.0.0-20190424203555-c05e17bb3b2d"],"ghsa_id":"GHSA-x3jr-pf6g-c48f","id":"tcs_01M5KFZXD887K4ZTRHZWAVGGRF","modified_at":"2026-02-04T03:17:37.933184Z","published_at":"2023-08-23T14:38:42Z","references":["https://osv.dev/vulnerability/GO-2023-1992","https://go-review.git.corp.google.com/c/crypto/+/173778","https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442","https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJ"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2023-1992","url":"https://osv.dev/vulnerability/GO-2023-1992"}],"summary":"Misleading message verification in golang.org/x/crypto/openpgp/clearsign"}