Message Forgery Vulnerability in Go Cryptography Libraries

CVE-2019-11841

What is CVE-2019-11841?

A message-forgery issue in the Go cryptography libraries permits attackers to spoof cleartext signed messages. The Clearsign package disregards the 'Hash' Armor Header, leading to potential misrepresentation of the message digest algorithms used in signatures. An attacker could embed arbitrary Armor Headers or prepend text to messages, which compromises the integrity of signed communications. This flaw highlights significant security concerns related to message authenticity and integrity.

References