The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirp-develUpgrade libslirpUpgrade python-podman-api | May 13, 2022 | Jun 17, 2020 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golang-docsUpgrade golang-binUpgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-race | Oct 2, 2020 | Jun 17, 2020 |
| Amazon_linux | — | Upgrade golang | Oct 28, 2020 | Jun 17, 2020 |
| Centos_linux | — | No Centos packages or updates have been released to address this issue | Sep 9, 2020 | Jun 17, 2020 |
| Debian | — | Upgrade golang-golang-x-text | Jul 30, 2024 | Jun 17, 2020 |
| Oracle_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade python-podman-apiUpgrade libslirpUpgrade container-selinuxUpgrade skopeo-testsUpgrade slirp4netnsUpgrade golang-raceUpgrade golang-srcUpgrade go-toolsetUpgrade libslirp-develUpgrade golang-miscUpgrade python3-criuUpgrade containers-commonUpgrade delveUpgrade conmonUpgrade golangUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade critUpgrade criuUpgrade fuse-overlayfsUpgrade golang-binUpgrade crunUpgrade cockpit-podmanUpgrade buildah-testsUpgrade buildahUpgrade udicaUpgrade skopeoUpgrade podman-remoteUpgrade golang-docsUpgrade podman-dockerUpgrade runcUpgrade podmanUpgrade podman-testsUpgrade golang-tests | Sep 12, 2020 | Jun 17, 2020 |
| Redhat Openshift | — | Upgrade podmanUpgrade skopeo | Dec 29, 2020 | Jun 17, 2020 |
| Redhat_linux | — | Upgrade container-selinuxUpgrade buildah-tests-debuginfoUpgrade runcUpgrade skopeoUpgrade delve-debuginfoUpgrade golangUpgrade libslirp-develUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-debugsourceNo solution existsUpgrade podman-debuginfoUpgrade skopeo-testsUpgrade python3-criuUpgrade golang-binUpgrade criuUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade podman-remote-debuginfoUpgrade golang-docsUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade delve-debugsourceUpgrade criu-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirp-debugsourceUpgrade udicaUpgrade golang-testsUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delveUpgrade runc-debuginfoUpgrade golang-srcUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade critUpgrade libslirp-debuginfoUpgrade podmanUpgrade slirp4netns-debuginfoUpgrade go-toolsetUpgrade crunUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debuginfoUpgrade libslirpUpgrade podman-testsUpgrade toolboxUpgrade buildahUpgrade python-podman-apiUpgrade cockpit-podmanUpgrade golang-raceUpgrade containernetworking-plugins-debuginfoUpgrade golang-miscUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-dockerUpgrade buildah-testsUpgrade crun-debuginfoUpgrade slirp4netnsUpgrade skopeo-debugsource | Sep 9, 2020 | Jun 17, 2020 |
| Rocky_linux | — | Upgrade libslirp-develUpgrade libslirpUpgrade libslirp-debugsourceUpgrade libslirp-debuginfo | Mar 12, 2024 | Jun 17, 2020 |
| Ubuntu | — | Upgrade golang-x-text-devUpgrade golang-golang-x-text-dev | Mar 22, 2023 | Jun 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub