encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-srcUpgrade golang-miscUpgrade golang-binUpgrade golangUpgrade golang-testsUpgrade golang-docsUpgrade golang-raceUpgrade go-toolset | May 4, 2022 | Mar 11, 2021 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 10, 2021 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golang-sharedUpgrade golang-docsUpgrade golang-binUpgrade golang-miscUpgrade golangUpgrade golang-raceUpgrade golang-src | Sep 30, 2022 | Mar 11, 2021 |
| Amazon_linux | — | Upgrade golang | Dec 5, 2023 | Mar 11, 2021 |
| Centos_linux | — | Upgrade golang-docsUpgrade delveUpgrade go-toolsetUpgrade golang-binUpgrade golang-raceUpgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-testsUpgrade delve-debuginfoUpgrade delve-debugsource | Aug 12, 2021 | Mar 11, 2021 |
| Debian | — | Upgrade golang-1.15 | Jul 30, 2024 | Mar 11, 2021 |
| Freebsd | — | Upgrade go | Mar 11, 2021 | Mar 10, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Mar 11, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-binUpgrade golang-src | Jul 19, 2021 | Mar 11, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Jun 28, 2021 | Mar 11, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jul 2, 2021 | Mar 11, 2021 |
| Oracle_linux | — | Upgrade conmonUpgrade istioUpgrade cri-toolsUpgrade helmUpgrade golang-raceUpgrade etcdUpgrade kubernetes-cni-pluginsUpgrade kata-runtimeUpgrade kata-proxyUpgrade delveUpgrade kubectlUpgrade olcne-api-serverUpgrade olcne-istio-chartUpgrade kata-agentUpgrade golang-docsUpgrade golang-binUpgrade kata-ksm-throttlerUpgrade corednsUpgrade kubeadmUpgrade istio-pilot-discoveryUpgrade go-toolsetUpgrade istio-mixsUpgrade golang-testsUpgrade kata-shimUpgrade golangUpgrade kata-imageUpgrade kataUpgrade cri-oUpgrade kubernetes-dashboardUpgrade kubernetes-cniUpgrade istio-mixcUpgrade golang-miscUpgrade flannelUpgrade istio-istioctlUpgrade yqUpgrade kubeletUpgrade istio-pilot-agentUpgrade olcne-prometheus-chartUpgrade golang-srcUpgrade olcnectlUpgrade olcne-agentUpgrade olcne-utilsUpgrade olcne-nginx | May 29, 2021 | Mar 10, 2021 |
| Redhat_linux | — | Upgrade golang-srcUpgrade delve-debuginfoUpgrade delveUpgrade go-toolsetUpgrade golang-raceUpgrade golang-docsUpgrade golang-miscNo solution existsUpgrade golangUpgrade golang-binUpgrade golang-testsUpgrade delve-debugsource | Aug 12, 2021 | Mar 11, 2021 |
| Rocky_linux | — | Upgrade delveUpgrade go-toolsetUpgrade golang-binUpgrade golang-raceUpgrade delve-debuginfoUpgrade delve-debugsourceUpgrade golang | Mar 12, 2024 | Mar 11, 2021 |
| Suse | — | Upgrade go1.16-docUpgrade go1.15Upgrade go1.15-docUpgrade go1.15-raceUpgrade go1.16Upgrade go1.16-race | Mar 25, 2021 | Mar 11, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 10, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub