high
7.5
CWE
835 400
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2021-29482: denial of service in github.com/ulikunitz/xz

First published: Wed Aug 19 2020(Updated: )

### Impact xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. ### Patches The problem has been fixed in release v0.5.8. ### Workarounds Limit the size of the compressed file input to a reasonable size for your use case. ### References The standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated. ### For more information If you have any questions or comments about this advisory: * Open an issue in [xz](https://github.com/ulikunitz/xz/issues).

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
redhat/servicemesh<0:2.0.9-3.el8
0:2.0.9-3.el8
redhat/github.com/ulikunitz/xz<0.5.8
0.5.8
go/github.com/ulikunitz/xz<0.5.8
0.5.8
Tukaani XZ<0.5.8

Remedy

https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2021-29482?

    CVE-2021-29482 has been classified with a Medium severity due to its potential impact when handling malicious input.

  • How do I fix CVE-2021-29482?

    To fix CVE-2021-29482, update to version 0.5.8 of the xz library.

  • Which software is affected by CVE-2021-29482?

    CVE-2021-29482 affects the xz library implemented in Go and specifically certain versions of servicemesh and github.com/ulikunitz/xz.

  • What is the impact of CVE-2021-29482?

    The impact of CVE-2021-29482 is that it may cause an infinite loop when processing malformed xz container format input.

  • Is there a known patch for CVE-2021-29482?

    Yes, the patch for CVE-2021-29482 was implemented in version 0.5.8 of the affected library.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203