x/vulndb: potential Go vuln in github.com/coredns/coredns: GHSA-gv9j-4w24-q7vx

[GoVulnBot]

In GitHub Security Advisory GHSA-gv9j-4w24-q7vx, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/coredns/coredns	1.6.6	< 1.6.6

See doc/triage.md for instructions on how to triage this report.

package: github.com/coredns/coredns
versions:
  - introduced: v0.0.0
    fixed: v1.6.6
description: |
    ### Impact

    CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

    ### Patches
    The problem has been fixed in 1.6.6+.

    ### References
    - [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)

    ### For more information
    Please consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.
published: 2022-03-01T21:03:11Z
last_modified: 2022-03-01T22:49:13Z
ghsas:
  - GHSA-gv9j-4w24-q7vx

[neild]

Vulnerability in tool.

[tatianab]

Downstream of #8

[gopherbot]

Change https://go.dev/cl/451280 mentions this issue: data/excluded: reclassify GO-2022-0368.yaml as dependent

[gopherbot]

Change https://go.dev/cl/592767 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607217 mentions this issue: data/reports: unexclude 20 reports (15)