CVE-2020-16845 Withdrawn Advisory: Infinite loop in xz
An attacker can cause a denial of service via an infinite loop in Go's binary encoding functions by providing invalid inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-16845?
CVE-2020-16845 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 6 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
Weakness: CWE-835
Which versions are affected by CVE-2020-16845?
4 open source packages ship an affected version, including github.com/ulikunitz/xz, golang and stdlib. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ulikunitz/xz Go | All versions | 0.5.8 |
github.com/ulikunitz/xz Go | All versions | 0.5.8 |
golang Bitnami | All versions | 1.13.15, 1.14.7 |
stdlib Go | All versions | 1.13.15, 1.14.7 |
Linux distribution packages (3)
faq Red Hat:openshift:4.6::el8 | All versions | 0:0.0.6-5.el8 |
go1.13 openSUSE:Leap 15.1 | All versions | 1.13.15-lp151.8.1 |
go1.13 openSUSE:Leap 15.2 | All versions | 1.13.15-lp152.2.7.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Golang Go, Opensuse Leap.
How do I fix CVE-2020-16845?
Upgrade github.com/ulikunitz/xz to 0.5.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-16845 being exploited?
There is no known exploitation of CVE-2020-16845 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-79098, AZL-98940, BIT-golang-2020-16845, DEBIAN-CVE-2020-16845, GHSA-q6gq-997w-f55g, GO-2021-0142 and 6 more.