Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2020-14040

Published: 17 June 2020

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Priority

Low

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package Release Status
golang-x-text
Launchpad, Ubuntu, Debian
trusty Does not exist

eoan Ignored
(end of life)
impish Does not exist

hirsute Ignored
(end of life)
groovy Ignored
(end of life)
focal Ignored
(transition package that install golang-golang-x-text)
upstream
Released (0.3.3-1)
xenial Needed

jammy Does not exist

bionic
Released (0.0~git20170627.0.6353ef0-1ubuntu2.1)
lunar Does not exist

kinetic Does not exist

Patches:

upstream: https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e%5E%21/#F0
golang-golang-x-text
Launchpad, Ubuntu, Debian
bionic Does not exist

groovy Ignored
(end of life)
jammy Not vulnerable
(0.3.5-1)
focal
Released (0.3.2-4ubuntu0.1)
lunar Not vulnerable
(0.3.5-1)
hirsute
Released (0.3.5-1)
impish Not vulnerable
(0.3.5-1)
kinetic Not vulnerable
(0.3.5-1)
trusty Does not exist

upstream
Released (0.3.5)
xenial Does not exist

Patches:
upstream: https://github.com/golang/text/commit/23ae387dee1f

Severity score breakdown

Parameter Value
Base score 7.5
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H