Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
poc-dsa-verify-CVE-2019-17596 — Demonstration of Go's dsa.Verify bug (CVE-2019-17596) | Kitploit
Tools/GitHubGitHub/pquerna/poc-dsa-verify-cve-2019-17596
Vulnerability AnalysisExploitationCryptographyPapers & ResearchLearning & Education
GitHubpquerna/poc-dsa-verify-cve-2019-17596

poc-dsa-verify-CVE-2019-17596

Demonstration of Go's dsa.Verify bug (CVE-2019-17596)

View Repository
Website
16 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Exploiting dsa.Verify in Go (CVE-2019-17596)

Please see the associated blog post for details.

Running

Since versions of Go newer than 1.13.1 are patched, I;ve included a Dockerfile, that makes it easier to pin your Go version. Simply run Docker build:

root@kitploit:~
docker build .

There are two files of interest:

  • dsa_test.go: Contains a test case for causing dsa.Verify to panic/
  • ssh_test.go: Contains a test case for making an crypto/ssh.Client to panic via an evil SSH Host Key.

Improvements, bugs, adding feature, etc:

Please open issues in Github for ideas, bugs, and general thoughts. Pull requests are of course preferred :)

License

poc-dsa-verify-CVE-2019-17596 is licensed under the Apache License, Version 2.0

Download Tool