CVE-2019-11841

A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures.

• CWE-347

• http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
• https://go.googlesource.com/crypto/Product, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/09/msg00011.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00014.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
• https://sec-consult.com/Third Party Advisory
• https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
• https://go.googlesource.com/crypto/Product, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/09/msg00011.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00014.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
• https://sec-consult.com/Third Party Advisory
• https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841/Exploit, Third Party Advisory

Published

May 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11836The Rediffmail (aka com.rediff.mail.and) application 2.2.6 f…
• CVE-2019-11837njs through 0.3.1, used in NGINX, has a segmentation fault i…
• CVE-2019-11838njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-11839njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-1184An elevation of privilege vulnerability exists when Windows …6.7
• CVE-2019-11840An issue was discovered in the supplementary Go cryptography…5.9
• CVE-2019-11842An issue was discovered in Matrix Sydent before 1.0.3 and Sy…
• CVE-2019-11843The MailPoet plugin before 3.23.2 for WordPress allows remot…6.1
• CVE-2019-11844An HTML Injection vulnerability has been discovered on the R…
• CVE-2019-11845An HTML Injection vulnerability has been discovered on the R…
• CVE-2019-11846/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1…
• CVE-2019-11847An improper privilege management vulnerabitlity exists in AL…7.8