Vulnerability · Published Jun 17, 2020 · Assigned by mitre
CVE-2020-14040
High 7.5
In plain English
A high-severity security flaw in the libslirp package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libslirp | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2020:4694 |
| AlmaLinux:8 | libslirp-devel | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2020:4694 |
| AlmaLinux:8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39 | ALSA-2020:4694 |
| AlmaLinux:8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 | ALSA-2020:4694 |
| Debian:12 | golang-golang-x-text | 0.3.3-1 | DEBIAN-CVE-2020-14040 |
| Debian:13 | golang-golang-x-text | 0.3.3-1 | DEBIAN-CVE-2020-14040 |
| Debian:14 | golang-golang-x-text | 0.3.3-1 | DEBIAN-CVE-2020-14040 |
| Go | golang.org/x/text | 0.3.3 | GHSA-5rcv-m4m3-hfh7 |
| Go | golang.org/x/text | 0.3.3 | GO-2020-0015 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.6.0+783+10209741 | RLSA-2020:4694 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.5.0+709+440d5e7e | RLSA-2020:4694 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.4.0+556+40122d08 | RLSA-2020:4694 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2020:4694 |
| Rocky Linux:8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 | RLSA-2020:4694 |
| Rocky Linux:8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861 | RLSA-2020:4694 |
| Rocky Linux:8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d | RLSA-2020:4694 |
| Rocky Linux:8 | toolbox | 0:0.0.8-1.module+el8.4.0+556+40122d08 | RLSA-2020:4694 |
| Ubuntu:22.04:LTS | golang-golang-x-text | 0.3.7-1ubuntu0.20.04.1 | USN-5873-1 |
Affected products (as reported)
References
- https://groups.google.com/forum/#%21topic/golang-announce/bXVeAmGOqz0 x_refsource_MISC
- FEDORA-2020-a55f130272 vendor-advisory, x_refsource_FEDORA