PT-2020-13859 · Go+6 · X/Text+6
Published
2020-06-17
·
Updated
2023-02-16
·
CVE-2020-14040
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
x/text package versions prior to 0.3.3
Description
The issue is related to the UTF-16 decoder in the encoding/unicode component, which could enter an infinite loop if a single byte is provided to a UTF16 decoder instantiated with
UseBOM or ExpectBOM. This can cause the program to crash or run out of memory. An attacker could trigger this issue by providing a specially crafted input, potentially leading to a denial of service. The String function on the Decoder or passing the Decoder to golang.org/x/text/transform.String can also trigger the infinite loop.Recommendations
For versions prior to 0.3.3, update to version 0.3.3 or later to resolve the issue.
As a temporary workaround, consider avoiding the use of
UseBOM or ExpectBOM when instantiating UTF16 decoders until a patch is applied.
Restrict access to user-supplied input to minimize the risk of exploitation.Exploit
Fix
Infinite Loop
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Linuxmint
Red Hat
Rocky Linux
Ubuntu
X/Text