CVE-2020-29511: Critical severity Golang Go vulnerability
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Other sources
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.17.13-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-29511?
The severity of CVE-2020-29511 is critical with a CVSS score of 5.6.
What is CVE-2020-29511?
CVE-2020-29511 is a vulnerability in the encoding/xml package in Go that allows attackers to craft inputs that behave in conflicting ways during different stages of processing.
Which software is affected by CVE-2020-29511?
The Go programming language (all versions up to 1.17) and NetApp Trident are affected by CVE-2020-29511.
How can an attacker exploit CVE-2020-29511?
An attacker can exploit CVE-2020-29511 by crafting inputs that manipulate the semantics of element namespace prefixes during tokenization round-trips.
Are there any references for CVE-2020-29511?
Yes, the references for CVE-2020-29511 are available at the following URLs: [GitHub Advisory](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md) and [NetApp Advisory](https://security.netapp.com/advisory/ntap-20210129-0006/).