PT-2020-17182 · Go+1 · Encoding/Xml Package+1

Published 2020-12-14 · Updated 2024-03-06 · CVE-2020-29511

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions encoding/xml package in Go (all versions)

Description The issue arises from the encoding/xml package in Go not correctly preserving the semantics of element namespace prefixes during tokenization round-trips. This allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-115

Related Identifiers

AZL-6449

AZL-78896

BIT-GOLANG-2020-29511

CVE-2020-29511

Affected Products

Debian

Encoding/Xml Package

References · 16

• https://ubuntu.com/security/CVE-2020-29511 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6449 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-29511 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-29511 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-29511 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-29511 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-golang-2020-29511 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78896 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29511 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-29511 · Vendor Advisory
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md · Note
• https://t.me/cibsecurity/20768 · Telegram Post
• https://t.me/cybersecuritytechnologies/2330 · Telegram Post
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities · Note
• https://security.netapp.com/advisory/ntap-20210129-0006 · Note