CVE-2020-29509: Critical severity Golang Go vulnerability
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Other sources
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.17.13-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-29509?
The severity of CVE-2020-29509 is critical with a CVSS score of 5.6.
Which software versions are affected by CVE-2020-29509?
All versions of Go up to (but not including) 1.17 and Netapp Trident are affected by CVE-2020-29509.
How does CVE-2020-29509 affect the encoding/xml package in Go?
CVE-2020-29509 affects the encoding/xml package in Go by not correctly preserving the semantics of attribute namespace prefixes during tokenization round-trips.
How can an attacker exploit CVE-2020-29509?
An attacker can craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Are there any references available for CVE-2020-29509?
Yes, you can find references for CVE-2020-29509 at the following links: [GitHub Advisory](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md) and [Netapp Advisory](https://security.netapp.com/advisory/ntap-20210129-0006/).