Candidate: CVE-2020-14040
PublicDate: 2020-06-17 20:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
 https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
Description:
 The x/text package before 0.3.3 for Go has a vulnerability in
 encoding/unicode that could lead to the UTF-16 decoder entering an infinite
 loop, causing the program to crash or run out of memory. An attacker could
 provide a single byte to a UTF16 decoder instantiated with UseBOM or
 ExpectBOM to trigger an infinite loop if the String function on the Decoder
 is called, or the Decoder is passed to golang.org/x/text/transform.String.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
 https://github.com/golang/go/issues/39491
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]


Patches_golang-x-text:
 upstream: https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e%5E%21/#F0
upstream_golang-x-text: released (0.3.3-1)
precise/esm_golang-x-text: DNE
trusty_golang-x-text: ignored (out of standard support)
trusty/esm_golang-x-text: DNE
xenial_golang-x-text: ignored (end of standard support, was needed)
esm-infra/xenial_golang-x-text: needed
bionic_golang-x-text: needed
eoan_golang-x-text: ignored (reached end-of-life)
focal_golang-x-text: needed
groovy_golang-x-text: ignored (reached end-of-life)
hirsute_golang-x-text: ignored (reached end-of-life)
impish_golang-x-text: DNE
jammy_golang-x-text: DNE
devel_golang-x-text: DNE

Patches_golang-golang-x-text:
 upstream: https://github.com/golang/text/commit/23ae387dee1f
upstream_golang-golang-x-text: released (0.3.5)
precise/esm_golang-golang-x-text: DNE
trusty_golang-golang-x-text: DNE
trusty/esm_golang-golang-x-text: DNE
xenial_golang-golang-x-text: DNE
bionic_golang-golang-x-text: DNE
focal_golang-golang-x-text: needed
groovy_golang-golang-x-text: ignored (reached end-of-life)
hirsute_golang-golang-x-text: released (0.3.5-1)
impish_golang-golang-x-text: not-affected (0.3.5-1)
jammy_golang-golang-x-text: not-affected (0.3.5-1)
devel_golang-golang-x-text: not-affected (0.3.5-1)