CVE-2020-16845: Infinite loop in xz
Summary
GO-2021-0225: Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. Affects encoding/binary across 2 version ranges.
< 1.13.15
>= 1.14.0, < 1.14.7
Fixed in 1.13.15 or 1.14.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'github.com/ulikunitz/xz' package is a Go library that provides support for reading and writing files compressed with the XZ format. It is commonly used in Go applications for handling compressed data. However, versions of the package before 0.5.8 are vulnerable to an infinite read loop in the encoding/binary module. This vulnerability can be triggered by providing invalid inputs to the ReadUvarint and ReadVarint functions.
Vulnerability Detail
The vulnerability in 'github.com/ulikunitz/xz' allows an attacker to cause an infinite loop in the encoding/binary module by providing specially crafted input. This can lead to a denial of service (DoS) condition, where the application becomes unresponsive and consumes excessive CPU resources. The issue arises due to improper handling of invalid inputs, causing the ReadUvarint and ReadVarint functions to enter an infinite loop. Exploiting this vulnerability requires the attacker to have the ability to control the input data that is processed by the affected functions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.13.151.13.15go get encoding/binary@v1.13.15 -
>= 1.14.0, < 1.14.71.14.7go get encoding/binary@v1.14.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the 'github.com/ulikunitz/xz' package to the fixed version.
Conclusion
The 'github.com/ulikunitz/xz' package in versions before 0.5.8 is vulnerable to an infinite loop issue in the encoding/binary module. This can lead to a denial of service (DoS) condition. It is recommended to update the package to the fixed version to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for encoding/binary →
FAQ
This vulnerability can lead to a denial of service (DoS) condition, where the affected application becomes unresponsive and consumes excessive CPU resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file to the playground, and it will analyze your dependencies and alert you if any vulnerable versions are detected.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
Yes, this vulnerability can be exploited remotely if the affected application exposes a network interface or processes untrusted input from external sources.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for encoding/binary.
