Summary
USN-5725-1 fixed a vulnerability in Go. This update provides
the corresponding update for Ubuntu 16.04 LTS.
Original advisory details:
Diederik Loerakker, Jonny Rhea, Raúl Kripalani, and Preston
Van Loon discovered that Go incorrectly handled certain inputs.
An attacker could possibly use this issue to cause Go applications
to hang or crash, resulting in a denial of service.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | golang-1.13 | 1.13.8-1ubuntu1~16.04.3+esm2 |
Vulnerabilities 1
-
Unscored —
Unbounded read from invalid inputs in encoding/binary
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
References
-
report
https://ubuntu.com/security/CVE-2020-16845