CVE-2020-16845
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
02 / AFFECTED SOFTWARE
Affected packages
148 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
### Withdrawn Advisory This advisory has been withdrawn because alerts cannot be issued for the Go standard library at this time. ### Original Description Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs. Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint or ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs.
05 / REFERENCES
Further evidence
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html
- https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo
- https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q
- https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/
- https://security.netapp.com/advisory/ntap-20200924-0002/
- https://www.debian.org/security/2021/dsa-4848
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b
- https://github.com/ulikunitz/xz/issues/35
- https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo
- https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4
- https://nvd.nist.gov/vuln/detail/CVE-2020-16845
- https://security.netapp.com/advisory/ntap-20200924-0002
- https://go.dev/cl/247120
- https://go.dev/issue/40618
- https://go.googlesource.com/go/+/027d7241ce050d197e7fabea3d541ffbe3487258
- https://groups.google.com/g/golang-announce/c/NyPIaucMgXo