CVE-2019-11841

Name: CVE-2019-11841
Creator: NVD / NIST
Published: 2019-05-22T17:29:00.287+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.9/10EPSS 2.00%

Last modified Jun 17, 2026

CVE-2019-11841 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. EPSS estimates a 2.00% chance of exploitation in the next 30 days.

Description

A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures.

Metrics

CVSS 3.1

5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

2.00%

78.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-347

Affected Software

Vendor	Product	Versions
Golang	Crypto	2019-03-25
Debian	Debian Linux	8.0
Debian	Debian Linux	9.0

References

http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
https://go.googlesource.com/crypto/Product, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00011.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
https://sec-consult.com/Third Party Advisory
https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
https://go.googlesource.com/crypto/Product, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00011.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
https://sec-consult.com/Third Party Advisory
https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841/Exploit, Third Party Advisory

Timeline

Published: May 22, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-11841?

How severe is CVE-2019-11841?

CVE-2019-11841 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 2.00% probability of exploitation in the next 30 days.

How do I fix CVE-2019-11841?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-11841?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST