USN-5725-1 — golang-1.13 vulnerability

Summary

Diederik Loerakker, Jonny Rhea, Raúl Kripalani, and Preston
Van Loon discovered that Go incorrectly handled certain inputs.
An attacker could possibly use this issue to cause Go applications
to hang or crash, resulting in a denial of service.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	golang-1.13	1.13.8-1ubuntu1~18.04.4
Ubuntu · 20.04 LTS 20.04:LTS	golang-1.13	1.13.8-1ubuntu1.1
Ubuntu · 22.04 LTS 22.04:LTS	golang-1.13	1.13.8-1ubuntu2.22.04.1

Vulnerabilities 1

Unscored —

CVE-2020-16845

Unbounded read from invalid inputs in encoding/binary

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

Aug 6, 2020

References

report
https://ubuntu.com/security/CVE-2020-16845

golang-1.13 vulnerability

Summary

Fixed packages 3

Vulnerabilities 1

Unbounded read from invalid inputs in encoding/binary

References