CVE-2020-29510

Published: 14 December 2020

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Notes

Packages built using golang need to be rebuilt once the
vulnerability has been fixed. This CVE entry does not
list packages that need rebuilding outside of the main
repository or the Ubuntu variants with PPA overlays.

as of 2021-08-10, there likely won't be a fix for this issue
by the upstream go developers

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29510
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
• NVD
• Launchpad
• Debian

Bugs

• https://github.com/golang/go/issues/43168