UBUNTU-CVE-2020-14040

Description

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

• ubuntu•golang-golang-x-text

  < 0.3.2-4ubuntu0.1

• ubuntu•golang-x-text

  all | < 0.0~git20170627.0.6353ef0-1ubuntu2.1 | all

References (4)

• https://ubuntu.com/security/CVE-2020-14040
• https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
• https://ubuntu.com/security/notices/USN-5873-1
• https://www.cve.org/CVERecord?id=CVE-2020-14040