CVE-2020-16845

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Withdrawn Advisory

This advisory has been withdrawn because alerts cannot be issued for the Go standard library at this time.

Original Description

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs.

Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint or ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs.

Servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected (CVE-2020-15586).

Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This could lead to processing more input than expected when the caller is reading directly from the network and depends on ReadUvarint and ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs (CVE-2020-16845).

The golang package has been updated to version 1.13.15, fixing these issues and containing several other bug fixes and enhancements. See the 1.13 release notes and other references for details.

This update for go1.13 fixes the following issues:

• go1.13 was updated to version 1.13.5
• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.13 fixes the following issues:

• go1.13 was updated to version 1.13.5
• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

Diederik Loerakker, Jonny Rhea, Raúl Kripalani, and Preston Van Loon discovered that Go incorrectly handled certain inputs. An attacker could possibly use this issue to cause Go applications to hang or crash, resulting in a denial of service.

USN-5725-1 fixed a vulnerability in Go. This update provides the corresponding update for Ubuntu 16.04 LTS.

Original advisory details:

Diederik Loerakker, Jonny Rhea, Raúl Kripalani, and Preston Van Loon discovered that Go incorrectly handled certain inputs. An attacker could possibly use this issue to cause Go applications to hang or crash, resulting in a denial of service.