Vulnerability · Published Jan 2, 2021 · Assigned by mitre
CVE-2020-28851
High 7.5
In plain English
A high-severity security flaw in the aardvark-dns package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.3%top 16.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.0.1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | buildah | 1:1.24.2-4.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | buildah-tests | 1:1.24.2-4.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | cockpit-podman | 43-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | conmon | 2:2.1.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | container-selinux | 2:2.179.1-1.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.0.1-2.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | containers-common | 2:1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | crun | 1.4.4-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | fuse-overlayfs | 1.8.2-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | git-lfs | 2.13.3-3.el8_6 | ALSA-2022:7129 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | netavark | 2:1.0.1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.3-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | podman | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:9 | podman | 2:4.2.0-3.el9 | ALSA-2022:7954 |
| AlmaLinux:8 | podman-catatonit | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-docker | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:9 | podman-docker | 2:4.2.0-3.el9 | ALSA-2022:7954 |
| AlmaLinux:8 | podman-gvproxy | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:9 | podman-gvproxy | 2:4.2.0-3.el9 | ALSA-2022:7954 |
| AlmaLinux:8 | podman-plugins | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:9 | podman-plugins | 2:4.2.0-3.el9 | ALSA-2022:7954 |
| AlmaLinux:8 | podman-remote | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:9 | podman-remote | 2:4.2.0-3.el9 | ALSA-2022:7954 |
| AlmaLinux:8 | podman-tests | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:9 | podman-tests | 2:4.2.0-3.el9 | ALSA-2022:7954 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | python3-podman | 4.0.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | runc | 1:1.0.3-2.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | skopeo | 2:1.6.1-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | skopeo-tests | 2:1.6.1-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | slirp4netns | 1.1.8-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | toolbox | 0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | udica | 0.2.6-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| Debian:12 | golang-golang-x-text | 0.3.6-1 | DEBIAN-CVE-2020-28851 |
| Debian:13 | golang-golang-x-text | 0.3.6-1 | DEBIAN-CVE-2020-28851 |
| Debian:14 | golang-golang-x-text | 0.3.6-1 | DEBIAN-CVE-2020-28851 |
| Rocky Linux:8 | git-lfs | 0:2.13.3-3.el8_6 | RLSA-2022:7129 |
| Ubuntu:22.04:LTS | golang-golang-x-text | 0.3.7-1ubuntu0.20.04.1 | USN-5873-1 |
Affected products (as reported)
References
- https://github.com/golang/go/issues/42535 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210212-0004/ x_refsource_CONFIRM