Withdrawn Advisory: Infinite loop in xz

Withdrawn Advisory

This advisory has been withdrawn because alerts cannot be issued for the Go standard library at this time.

Original Description

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-16845

• ulikunitz/xz#35

• ulikunitz/xz@69c6093

• https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo

• https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q

• https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html

• https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html

• https://www.debian.org/security/2021/dsa-4848

• https://www.oracle.com/security-alerts/cpuApr2021.html

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4

• https://security.netapp.com/advisory/ntap-20200924-0002