CVE-2021-29482 denial of service in github.com/ulikunitz/xz
An attacker can cause a denial of service by providing malicious input to the xz decompression library, leading to an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29482?
CVE-2021-29482 is a high-severity denial of service vulnerability in ulikunitz xz, published on 28 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
Weakness: CWE-835
Which versions are affected by CVE-2021-29482?
3 open source packages ship an affected version, including github.com/ulikunitz/xz. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ulikunitz/xz Go | All versions | 0.5.8 |
github.com/ulikunitz/xz Go | All versions | 0.5.8 |
github.com/ulikunitz/xz Go | All versions | 0.5.8 |
Products include Xz Project Xz.
How do I fix CVE-2021-29482?
Upgrade github.com/ulikunitz/xz to 0.5.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-29482 being exploited?
There is no known exploitation of CVE-2021-29482 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2021-29482, GHSA-25xm-hr59-7c27, GO-2020-0016, UBUNTU-CVE-2021-29482.