Infinite loop in Apache Commons Text - CVE-2020-14040

Vulnerability identifier: #VU34248

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14040

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Apache Commons Text
Red Hat Developer Tools
IBM CICS TX Advanced
IBM CICS TX Standard
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
skopeo (Red Hat package)
podman (Red Hat package)
buildah (Red Hat package)
golang-x-text-dev (Ubuntu package)
golang-golang-x-text-dev (Ubuntu package)
tini (Red Hat package)
go-toolset-1.13 (Red Hat package)
go-toolset-1.13-golang (Red Hat package)
golang
mcg (Red Hat package)
Red Hat OpenShift Serverless
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat Advanced Cluster Management for Kubernetes
IBM MQ Operator
IBM Edge Application Manager
Red Hat OpenShift Container Platform
Storage Defender – Data Protect
IBM Watson Machine Learning Accelerator
IBM Cloud Pak for Watson AIOps
IBM supplied MQ Advanced container images
Robotic Process Automation for Cloud Pak
Cloud Pak for Security (CP4S)

Install update from vendor's website.

skopeo (Red Hat package) - update to 0.1.40-12.el7_9
podman (Red Hat package) - update to 1.6.4-26.el7_9
Red Hat OpenShift Serverless - update to 1.11.0
buildah (Red Hat package) - update to 1.11.6-12.el7_9
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.1.5, 2.1.6, 2.2.2
golang-x-text-dev (Ubuntu package) - update to 0.0~git20170627.0.6353ef0-1ubuntu2.1
golang-golang-x-text-dev (Ubuntu package) - addressed in versions 0.0~git20170627.0.6353ef0-1ubuntu2.1, 0.3.2-4ubuntu0.1, 0.3.7-1ubuntu0.20.04.1, 0.3.7-1ubuntu0.22.10.1
tini (Red Hat package) - update to 0.18.0-5.el8
Storage Defender – Data Protect - update to 1.3.0
Cloud Pak for Security (CP4S) - update to 1.10.10.0
go-toolset-1.13 (Red Hat package) - update to 1.13.15-1.el7
go-toolset-1.13-golang (Red Hat package) - update to 1.13.15-3.el7
golang - addressed in versions 1.14.7-1.fc32, 1.15-1.el6, 1.15-1.el7
IBM MQ Operator - addressed in versions 2.0.13, 2.4.2
IBM Watson Machine Learning Accelerator - update to 2.3.9
IBM Cloud Pak for Watson AIOps - update to 4.4.0
Red Hat OpenShift Container Platform - update to 4.5.8
mcg (Red Hat package) - update to 5.6.0-39.2279a46.5.6.el8
IBM supplied MQ Advanced container images - update to 9.3.0.10-r1
IBM CICS TX Advanced - update to 11.1.0.0 ifix5
IBM CICS TX Standard - update to 11.1.0.0 ifix5
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.10, 23.0.10

• https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0

• Infinite loop in Apache Commons Text
• Red Hat Developer Tools update for go-toolset-1.13 and go-toolset-1.13-golang
• Amazon Linux AMI update for golang
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 7 Extras update for skopeo
• Red Hat Enterprise Linux 7 Extras update for buildah
• Red Hat Enterprise Linux 7 Extras update for podman
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Red Hat OpenShift Container Storage 4 update for mcg
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Ubuntu update for golang-golang-x-text
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Storage Defender Data Protect
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.1
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.5
• Fedora EPEL 7 update for golang
• Fedora EPEL 6 update for golang
• Fedora 32 update for golang
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2