The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-podman-apiUpgrade libslirpUpgrade libslirp-devel | May 13, 2022 | Jun 17, 2020 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golangUpgrade golang-raceUpgrade golang-miscUpgrade golang-testsUpgrade golang-docsUpgrade golang-bin | Oct 2, 2020 | Jun 17, 2020 |
| Amazon_linux | — | Upgrade golang | Oct 28, 2020 | Jun 17, 2020 |
| Centos_linux | — | No Centos packages or updates have been released to address this issue | Sep 9, 2020 | Jun 17, 2020 |
| Debian | — | Upgrade golang-golang-x-text | Jul 30, 2024 | Jun 17, 2020 |
| Oracle_linux | — | Upgrade critUpgrade criuUpgrade crunUpgrade udicaUpgrade podman-dockerUpgrade buildah-testsUpgrade cockpit-podmanUpgrade podman-remoteUpgrade golang-binUpgrade golang-testsUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade buildahUpgrade golangUpgrade runcUpgrade skopeoUpgrade podman-testsUpgrade podmanUpgrade golang-docsUpgrade go-toolsetUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade containers-commonUpgrade golang-raceUpgrade libslirp-develUpgrade python3-criuUpgrade libslirpUpgrade python-podman-apiUpgrade golang-srcUpgrade golang-miscUpgrade delveUpgrade slirp4netnsUpgrade container-selinuxUpgrade conmon | Sep 12, 2020 | Jun 17, 2020 |
| Redhat Openshift | — | Upgrade podmanUpgrade skopeo | Dec 29, 2020 | Jun 17, 2020 |
| Redhat_linux | — | Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade buildah-debuginfoUpgrade golang-docsUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade delveUpgrade python3-criuUpgrade buildah-debugsourceUpgrade containers-commonUpgrade podman-catatonitUpgrade udicaUpgrade oci-seccomp-bpf-hookUpgrade runc-debuginfoUpgrade golang-srcUpgrade golang-testsUpgrade container-selinuxUpgrade golangUpgrade libslirp-debuginfoUpgrade delve-debugsourceUpgrade delve-debuginfoUpgrade podmanUpgrade criuUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade libslirp-debugsourceUpgrade critUpgrade containernetworking-pluginsUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-testsUpgrade podman-remoteNo solution existsUpgrade golang-binUpgrade runcUpgrade criu-debuginfoUpgrade skopeoUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-debuginfoUpgrade libslirpUpgrade buildah-testsUpgrade go-toolsetUpgrade buildahUpgrade python-podman-apiUpgrade golang-raceUpgrade podman-dockerUpgrade toolboxUpgrade conmonUpgrade podman-testsUpgrade crun-debuginfoUpgrade golang-miscUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netnsUpgrade crunUpgrade cockpit-podman | Sep 9, 2020 | Jun 17, 2020 |
| Rocky_linux | — | Upgrade libslirp-debuginfoUpgrade libslirp-develUpgrade libslirp-debugsourceUpgrade libslirp | Mar 12, 2024 | Jun 17, 2020 |
| Ubuntu | — | Upgrade golang-x-text-devUpgrade golang-golang-x-text-dev | Mar 22, 2023 | Jun 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub