The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirp-develUpgrade python-podman-apiUpgrade libslirp | May 13, 2022 | Jun 17, 2020 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-race | Oct 2, 2020 | Jun 17, 2020 |
| Amazon_linux | — | Upgrade golang | Oct 28, 2020 | Jun 17, 2020 |
| Centos_linux | — | No Centos packages or updates have been released to address this issue | Sep 9, 2020 | Jun 17, 2020 |
| Debian | — | Upgrade golang-golang-x-text | Jul 30, 2024 | Jun 17, 2020 |
| Oracle_linux | — | Upgrade podman-remoteUpgrade udicaUpgrade golang-testsUpgrade buildah-testsUpgrade skopeoUpgrade critUpgrade buildahUpgrade podman-dockerUpgrade crunUpgrade cockpit-podmanUpgrade runcUpgrade criuUpgrade golang-docsUpgrade podmanUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade golangUpgrade podman-testsUpgrade containernetworking-pluginsUpgrade golang-binUpgrade delveUpgrade conmonUpgrade containers-commonUpgrade golang-srcUpgrade golang-raceUpgrade python-podman-apiUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade go-toolsetUpgrade libslirp-develUpgrade golang-miscUpgrade python3-criuUpgrade skopeo-testsUpgrade container-selinuxUpgrade slirp4netns | Sep 12, 2020 | Jun 17, 2020 |
| Redhat Openshift | — | Upgrade podmanUpgrade skopeo | Dec 29, 2020 | Jun 17, 2020 |
| Redhat_linux | — | Upgrade skopeo-debuginfoUpgrade cockpit-podmanUpgrade toolboxUpgrade golang-miscUpgrade containernetworking-plugins-debugsourceUpgrade python-podman-apiUpgrade libslirpUpgrade buildah-testsUpgrade podman-testsUpgrade crun-debuginfoUpgrade go-toolsetUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmonUpgrade crunUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade buildahUpgrade containernetworking-plugins-debuginfoUpgrade golang-raceUpgrade podman-dockerUpgrade udicaUpgrade criuUpgrade fuse-overlayfs-debugsourceUpgrade podman-debugsourceUpgrade libslirp-debuginfoUpgrade golang-binUpgrade golang-testsNo solution existsUpgrade oci-seccomp-bpf-hookUpgrade podman-debuginfoUpgrade podman-remoteUpgrade skopeo-testsUpgrade critUpgrade podman-catatonitUpgrade containers-commonUpgrade delveUpgrade criu-debugsourceUpgrade libslirp-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-debugsourceUpgrade container-selinuxUpgrade podmanUpgrade delve-debuginfoUpgrade libslirp-develUpgrade python3-criuUpgrade golangUpgrade fuse-overlayfsUpgrade golang-docsUpgrade slirp4netns-debugsourceUpgrade podman-catatonit-debuginfoUpgrade runcUpgrade podman-remote-debuginfoUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade skopeoUpgrade delve-debugsourceUpgrade golang-srcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-plugins | Sep 9, 2020 | Jun 17, 2020 |
| Rocky_linux | — | Upgrade libslirp-debuginfoUpgrade libslirpUpgrade libslirp-develUpgrade libslirp-debugsource | Mar 12, 2024 | Jun 17, 2020 |
| Ubuntu | — | Upgrade golang-x-text-devUpgrade golang-golang-x-text-dev | Mar 22, 2023 | Jun 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub