CVE-2020-29509

Published: 14 December 2020

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Notes

Packages built using golang need to be rebuilt once the
vulnerability has been fixed. This CVE entry does not
list packages that need rebuilding outside of the main
repository or the Ubuntu variants with PPA overlays.

as of 2021-08-10, there likely won't be a fix for this issue
by the upstream go developers

Status

Severity score breakdown

References

• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
• https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg
• https://www.cve.org/CVERecord?id=CVE-2020-29509
• NVD
• Launchpad
• Debian

Bugs

• https://github.com/golang/go/issues/43168