The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly     generates random numbers because math/rand is used. The TXID becomes predictable, leading to response     forgeries. (CVE-2019-19794)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly
    generates random numbers because math/rand is used. The TXID becomes predictable, leading to response
    forgeries. (CVE-2019-19794)

An update of the telegraf package has been released.

An update of the kapacitor package has been released.

ID	Name	Product	Family	Severity
250999	Linux Distros Unpatched Vulnerability : CVE-2019-19794	Nessus	Misc.	medium
409943	SCA: security update for github.com/miekg/dns (GHSA-44r7-7p62-q3fr)	Tenable Cloud Security	SCA Checks	medium
409943	SCA: security update for github.com/miekg/dns (GHSA-44r7-7p62-q3fr)	Tenable Self-Hosted Container Security	SCA Checks	medium
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	high
204224	Photon OS 5.0: Kapacitor PHSA-2023-5.0-0045	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2019-19794

medium

Tenable Plugins

medium

medium

medium

high

critical