Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-27918

Опубликовано: 10 мар. 2021
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

An infinite loop vulnerability was found in golang. If an application defines a custom token parser initializing with xml.NewTokenDecoder it is possible for the parsing loop to never return. An attacker could potentially craft a malicious XML document which has an XML element with EOF within it, causing the parsing application to endlessly loop, resulting in a Denial of Service (DoS).

Отчет

OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM), Red Hat OpenShift Jaeger (RHOSJ) and OpenShift Virtualization all bundle vulnerable versions of the golang standard library (stdlib). However, no component within each product utilizes the function xml.NewTokenDecoder which is a requirement to be vulnerable. Hence, all affected components are marked as "Will not fix". Additionally no OCP container has been listed, as nearly all available containers are compiled with an affected version of Go, but do not utilize the function xml.NewTokenDecoder. Red Hat Ceph Storage (RHCS), Red Hat Gluster Storage 3 and OpenShift Container Storage 4 also bundles a vulnerable version of golang standard library 'encoding/xml', but does not utilize the function xml.NewTokenDecoder, and hence this issue has been rated as having a security impact of Low.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Distributed Tracing Jaeger 1distributed-tracing/jaeger-all-in-one-rhel8Will not fix
Distributed Tracing Jaeger 1distributed-tracing/jaeger-collector-rhel8Will not fix
Distributed Tracing Jaeger 1distributed-tracing/jaeger-rhel8-operatorWill not fix
OpenShift Serverlessknative-eventingWill not fix
OpenShift Serverlessknative-servingWill not fix
OpenShift Service Mesh 2.0servicemeshWill not fix
OpenShift Service Mesh 2.0servicemesh-grafanaWill not fix
OpenShift Service Mesh 2.0servicemesh-operatorWill not fix
OpenShift Service Mesh 2.0servicemesh-prometheusWill not fix
Red Hat Ceph Storage 2golangOut of support scope

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-835
https://bugzilla.redhat.com/show_bug.cgi?id=1937901golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader

EPSS

Процентиль: 7%
0.00025
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 5 лет назад

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

CVSS3: 7.5
nvd
около 5 лет назад

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

CVSS3: 7.5
msrc
около 5 лет назад

Описание отсутствует

CVSS3: 7.5
debian
около 5 лет назад

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infin ...

suse-cvrf
почти 5 лет назад

Security update for go1.15

EPSS

Процентиль: 7%
0.00025
Низкий

7.5 High

CVSS3