Vulnerability · Published Dec 14, 2020 · Assigned by Mattermost

CVE-2020-29510

Critical 9.8

In plain English

A critical-severity security flaw in Go from Golang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.1%top 18.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Affected products (as reported)

Vendor	Product	Versions
Golang	Go	unspecified – through 1.15

Weakness: CWE-115 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210129-0006/ x_refsource_CONFIRM