CVE-2019-11840

Name	CVE-2019-11840
Description	An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1840-1, DLA-2402-1, DLA-2442-1, DLA-2454-1, DLA-2527-1, DLA-3455-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-go.crypto (PTS)	bullseye	1:0.0~git20201221.eec23a3-1	fixed
	bookworm	1:0.4.0-1	fixed
	sid, trixie	1:0.25.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
golang-go.crypto	source	jessie	0.0~hg190-1+deb8u1	DLA-1840-1
golang-go.crypto	source	stretch	1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1	DLA-2402-1
golang-go.crypto	source	buster	1:0.0~git20181203.505ab14-1+deb10u1	DLA-3455-1
golang-go.crypto	source	(unstable)	1:0.0~git20200221.2aa609c-1
obfs4proxy	source	stretch	0.0.7-1+deb8u1	DLA-2442-1
rclone	source	stretch	1.35-1+deb8u1	DLA-2454-1
snapd	source	stretch	2.21-2+deb9u1	DLA-2527-1

Notes

https://github.com/golang/go/issues/30965
https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d
https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ