Vulnerability · Published Aug 6, 2020 · Assigned by mitre
CVE-2020-16845
High 7.5
In plain English
A high-severity security flaw in the go package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.9% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.9%top 7.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | go | 1.15-r0 | ALPINE-CVE-2020-16845 |
| Alpine:v3.21 | go | 1.15-r0 | ALPINE-CVE-2020-16845 |
| Alpine:v3.22 | go | 1.15-r0 | ALPINE-CVE-2020-16845 |
| Alpine:v3.23 | go | 1.15-r0 | ALPINE-CVE-2020-16845 |
| Alpine:v3.24 | go | 1.15-r0 | ALPINE-CVE-2020-16845 |
| Go | github.com/ulikunitz/xz | 0.5.8 | GHSA-q6gq-997w-f55g |
| Go | stdlib | 1.13.15, 1.14.7 | GO-2021-0142 |
| Ubuntu:22.04:LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.1 | UBUNTU-CVE-2020-16845 |
| Ubuntu:22.04:LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.1 | USN-5725-1 |
Affected products (as reported)
References
- https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q x_refsource_MISC
- openSUSE-SU-2020:1178 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1194 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-e384830a0d vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-deff052e7a vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-a55f130272 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-b190375a37 vendor-advisory, x_refsource_FEDORA
- openSUSE-SU-2020:1405 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1407 vendor-advisory, x_refsource_SUSE
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update mailing-list, x_refsource_MLIST
- DSA-4848 vendor-advisory, x_refsource_DEBIAN
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20200924-0002/ x_refsource_CONFIRM