CVE-2020-14040: High severity Golang text vulnerability
A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.
Other sources
Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
Specific Go Packages Affected golang.org/x/text/encoding/unicode golang.org/x/text/transform
— GitHub
Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
Upstream Reference:
https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0?pli=1
— Red Hat
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2021:1129
- RHSA-2020:5149
- RHSA-2020:3369
- RHSA-2020:4214
- RHSA-2020:5054
- RHSA-2020:5055
- RHSA-2020:5056
- RHSA-2020:3665
- RHSA-2020:4694
- RHSA-2021:2039
- RHSA-2021:3140
- RHSA-2020:3727
- RHSA-2020:3783
- RHSA-2020:3578
- RHSA-2020:4297
- RHSA-2020:4298
- RHSA-2020:5633
- RHSA-2020:5635
- RHSA-2020:5605
- RHSA-2020:5606
- RHSA-2021:0799
- RHSA-2021:0420
Frequently Asked Questions
What is CVE-2020-14040?
CVE-2020-14040 is a vulnerability in the x/text package for Go that could cause a program to crash or run out of memory due to an infinite loop in the UTF-16 decoder.
What is the severity of CVE-2020-14040?
CVE-2020-14040 has a severity score of 7.5 (high).
How can I fix CVE-2020-14040?
To fix CVE-2020-14040, update the x/text package to version 0.3.3 or higher.
Where can I find more information about CVE-2020-14040?
You can find more information about CVE-2020-14040 at the following sources: CVE website, NIST NVD, Go Issue Tracker, Red Hat Bugzilla, and Red Hat Security Advisory.
What are the CWE IDs associated with CVE-2020-14040?
The CWE IDs associated with CVE-2020-14040 are 835 and 400.