Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2020-14040

Published: 17 June 2020

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Priority

Low

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package Release Status
golang-golang-x-text
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needed

groovy Ignored
(reached end-of-life)
hirsute
Released (0.3.5-1)
impish Not vulnerable
(0.3.5-1)
jammy Not vulnerable
(0.3.5-1)
kinetic Not vulnerable
(0.3.5-1)
precise Does not exist

trusty Does not exist

upstream
Released (0.3.5)
xenial Does not exist

Patches:
upstream: https://github.com/golang/text/commit/23ae387dee1f

golang-x-text
Launchpad, Ubuntu, Debian
bionic Needed

eoan Ignored
(reached end-of-life)
focal Needed

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (0.3.3-1)
xenial Needed

Patches:

upstream: https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e%5E%21/#F0

Severity score breakdown

Parameter Value
Base score 7.5
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H