CVE-2019-19794

Name of the Vulnerable Software and Affected Versions miekg Go DNS package versions prior to 1.1.25 CoreDNS versions prior to 1.6.6

Description The issue arises from the improper generation of random numbers due to the use of math/rand, making DNS message transaction IDs predictable. This predictability reduces the complexity of response spoofing attacks against DNS clients.

Recommendations For miekg Go DNS package versions prior to 1.1.25, update to version 1.1.25 or later to resolve the issue. For CoreDNS versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue.