The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirp-develUpgrade python-podman-apiUpgrade libslirp | May 13, 2022 | Jun 17, 2020 |
| Amazon Linux Ami 2 | — | Upgrade golangUpgrade golang-raceUpgrade golang-miscUpgrade golang-srcUpgrade golang-binUpgrade golang-docsUpgrade golang-tests | Oct 2, 2020 | Jun 17, 2020 |
| Amazon_linux | — | Upgrade golang | Oct 28, 2020 | Jun 17, 2020 |
| Centos_linux | — | No Centos packages or updates have been released to address this issue | Sep 9, 2020 | Jun 17, 2020 |
| Debian | — | Upgrade golang-golang-x-text | Jul 30, 2024 | Jun 17, 2020 |
| Oracle_linux | — | Upgrade golang-raceUpgrade delveUpgrade go-toolsetUpgrade libslirp-develUpgrade python3-criuUpgrade containers-commonUpgrade conmonUpgrade golang-miscUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade golang-srcUpgrade slirp4netnsUpgrade python-podman-apiUpgrade container-selinuxUpgrade skopeo-testsUpgrade buildah-testsUpgrade podmanUpgrade udicaUpgrade golang-binUpgrade podman-testsUpgrade podman-dockerUpgrade crunUpgrade buildahUpgrade critUpgrade skopeoUpgrade golang-testsUpgrade criuUpgrade golangUpgrade runcUpgrade golang-docsUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade cockpit-podman | Sep 12, 2020 | Jun 17, 2020 |
| Redhat Openshift | — | Upgrade podmanUpgrade skopeo | Dec 29, 2020 | Jun 17, 2020 |
| Redhat_linux | — | Upgrade criu-debuginfoUpgrade container-selinuxUpgrade udicaUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade golangUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade podman-remoteNo solution existsUpgrade podmanUpgrade delve-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade buildah-debuginfoUpgrade podman-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade golang-docsUpgrade delveUpgrade podman-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade golang-binUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delve-debugsourceUpgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfsUpgrade critUpgrade criuUpgrade containers-commonUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade runcUpgrade runc-debugsourceUpgrade skopeoUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade golang-testsUpgrade python3-criuUpgrade golang-srcUpgrade podman-testsUpgrade buildah-testsUpgrade containernetworking-plugins-debuginfoUpgrade toolboxUpgrade conmonUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-raceUpgrade skopeo-debuginfoUpgrade go-toolsetUpgrade crun-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade podman-dockerUpgrade buildahUpgrade python-podman-apiUpgrade golang-miscUpgrade libslirpUpgrade skopeo-debugsource | Sep 9, 2020 | Jun 17, 2020 |
| Rocky_linux | — | Upgrade libslirp-debugsourceUpgrade libslirpUpgrade libslirp-develUpgrade libslirp-debuginfo | Mar 12, 2024 | Jun 17, 2020 |
| Ubuntu | — | Upgrade golang-x-text-devUpgrade golang-golang-x-text-dev | Mar 22, 2023 | Jun 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub