The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade python-podman-apiUpgrade libslirp-devel | May 13, 2022 | Jun 17, 2020 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golang-raceUpgrade golangUpgrade golang-miscUpgrade golang-testsUpgrade golang-docsUpgrade golang-bin | Oct 2, 2020 | Jun 17, 2020 |
| Amazon_linux | — | Upgrade golang | Oct 28, 2020 | Jun 17, 2020 |
| Centos_linux | — | No Centos packages or updates have been released to address this issue | Sep 9, 2020 | Jun 17, 2020 |
| Debian | — | Upgrade golang-golang-x-text | Jul 30, 2024 | Jun 17, 2020 |
| Oracle_linux | — | Upgrade conmonUpgrade python3-criuUpgrade containers-commonUpgrade delveUpgrade libslirpUpgrade python-podman-apiUpgrade oci-seccomp-bpf-hookUpgrade golang-srcUpgrade golang-miscUpgrade golang-raceUpgrade go-toolsetUpgrade libslirp-develUpgrade skopeo-testsUpgrade container-selinuxUpgrade slirp4netnsUpgrade podman-testsUpgrade critUpgrade podmanUpgrade criuUpgrade golang-docsUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade runcUpgrade cockpit-podmanUpgrade podman-remoteUpgrade buildah-testsUpgrade golangUpgrade udicaUpgrade buildahUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade crunUpgrade golang-binUpgrade golang-testsUpgrade skopeo | Sep 12, 2020 | Jun 17, 2020 |
| Redhat Openshift | — | Upgrade skopeoUpgrade podman | Dec 29, 2020 | Jun 17, 2020 |
| Redhat_linux | — | Upgrade libslirpUpgrade skopeo-debuginfoUpgrade crun-debuginfoUpgrade podman-dockerUpgrade cockpit-podmanUpgrade conmonUpgrade buildah-testsUpgrade python-podman-apiUpgrade golang-raceUpgrade slirp4netnsUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade buildahUpgrade go-toolsetUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debugsourceUpgrade golang-miscUpgrade podman-testsUpgrade containers-commonUpgrade podman-catatonit-debuginfoUpgrade podman-remote-debuginfoUpgrade containernetworking-pluginsUpgrade golang-docsUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade fuse-overlayfsUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-testsUpgrade libslirp-debuginfoUpgrade container-selinuxUpgrade buildah-debugsourceUpgrade delveUpgrade fuse-overlayfs-debugsourceUpgrade golang-binUpgrade fuse-overlayfs-debuginfoUpgrade podman-debugsourceNo solution existsUpgrade runc-debuginfoUpgrade udicaUpgrade oci-seccomp-bpf-hookUpgrade golang-srcUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade delve-debuginfoUpgrade python3-criuUpgrade criuUpgrade libslirp-develUpgrade podmanUpgrade golangUpgrade runc-debugsourceUpgrade skopeoUpgrade runcUpgrade criu-debugsourceUpgrade critUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade podman-remoteUpgrade buildah-debuginfoUpgrade podman-catatonitUpgrade podman-debuginfo | Sep 9, 2020 | Jun 17, 2020 |
| Rocky_linux | — | Upgrade libslirpUpgrade libslirp-debugsourceUpgrade libslirp-develUpgrade libslirp-debuginfo | Mar 12, 2024 | Jun 17, 2020 |
| Ubuntu | — | Upgrade golang-golang-x-text-devUpgrade golang-x-text-dev | Mar 22, 2023 | Jun 17, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub