Skip to content
OpenAdvisories
Medium ALAS2-2020-1494 2 CVEs

Moderate: golang security update (Amazon Linux 2)

Published Sep 28, 2020 · Updated Sep 30, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-16845: Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. 1867099: CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs CVE-2020-14040: The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String. 1853652: CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 golang 0:1.13.15-1.amzn2.0.1
Amazon Linux · 2 golang-bin 0:1.13.15-1.amzn2.0.1
Amazon Linux · 2 golang-docs 0:1.13.15-1.amzn2.0.1
Amazon Linux · 2 golang-misc 0:1.13.15-1.amzn2.0.1
Amazon Linux · 2 golang-race 0:1.13.15-1.amzn2.0.1
Amazon Linux · 2 golang-src 0:1.13.15-1.amzn2.0.1
Amazon Linux · 2 golang-tests 0:1.13.15-1.amzn2.0.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-14040.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-16845.html