Infinite loop in Go programming language - CVE-2020-16845

Vulnerability identifier: #VU45699

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-16845

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in "ReadUvarint" and "ReadVarint" in "encoding/binary". A remote attacker can consume all available system resources and cause denial of service conditions.

Go programming language
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Opensuse
Ubuntu
faq (Red Hat package)
openshift-eventrouter (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
containernetworking-plugins (Red Hat package)
ior (Red Hat package)
servicemesh (Red Hat package)
servicemesh-operator (Red Hat package)
servicemesh-cni (Red Hat package)
ignition (Red Hat package)
cri-tools (Red Hat package)
podman (Red Hat package)
cri-o (Red Hat package)
golang-1.11 (Debian package)
buildah (Red Hat package)
go (Alpine package)
apb (Red Hat package)
servicemesh-prometheus (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
machine-config-daemon (Red Hat package)
openshift-clients (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
servicemesh-grafana (Red Hat package)
golang-1.13-go (Ubuntu package)
golang-1.13 (Ubuntu package)
golang-1.13-src (Ubuntu package)
golang-github-ulikunitz-xz
tini (Red Hat package)
skopeo (Red Hat package)
go-toolset-1.13 (Red Hat package)
golang
go-toolset-1.13-golang (Red Hat package)
kubefed-client (Red Hat package)
mcg (Red Hat package)
redhat-release-coreos (Red Hat package)
ObjectScale
IBM Cloud Pak for Watson AIOps
Dell PowerProtect Cyber Recovery
Red Hat Developer Tools
OpenShift Service Mesh
Red Hat OpenShift Serverless
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
Red Hat OpenShift GitOps
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
QRadar Suite
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Automation Manager
OpenShift Logging
IBM Robotic Process Automation
Netcool Operations Insight

Install updates from vendor's website.

Go programming language - addressed in versions 1.13.15, 1.14.7
faq (Red Hat package) - addressed in versions 0.0.6-5.el7, 0.0.6-5.el8
openshift-eventrouter (Red Hat package) - addressed in versions 0.2-5.git7c289cc.el7, 0.2-6.git7c289cc.el8
golang-github-prometheus-promu (Red Hat package) - addressed in versions 0.5.0-3.git642a960.el7, 0.5.0-3.git642a960.el8
containernetworking-plugins (Red Hat package) - addressed in versions 0.8.6-2.rhaos4.5.el7, 0.8.6-2.rhaos4.5.el8
ior (Red Hat package) - update to 1.1.11-2.el8
servicemesh (Red Hat package) - update to 1.1.11-2.el8
servicemesh-operator (Red Hat package) - update to 1.1.11-3.el8
servicemesh-cni (Red Hat package) - update to 1.1.11-2.el8
ignition (Red Hat package) - update to 0.35.1-12.rhaos4.5.gitb4d18ad.el8
ObjectScale - update to 1.3.0
cri-tools (Red Hat package) - addressed in versions 1.18.0-4.el7, 1.18.0-4.el8, 1.20.0-3.el7
podman (Red Hat package) - update to 1.9.3-2.rhaos4.5.el8
cri-o (Red Hat package) - addressed in versions 1.18.3-19.rhaos4.5.git9264b4f.el7, 1.18.3-19.rhaos4.5.git9264b4f.el8, 1.18.4-4.rhaos4.5.git6dee389.el7, 1.18.4-4.rhaos4.5.git6dee389.el8, 1.18.4-7.rhaos4.5.git572d9f7.el7, 1.18.4-7.rhaos4.5.git572d9f7.el8, 1.20.2-12.rhaos4.7.git9f7be76.el7, 1.20.2-12.rhaos4.7.git9f7be76.el8
OpenShift Service Mesh - update to 1.1.11
Migration Toolkit for Containers - update to 1.7.4
Red Hat OpenShift Serverless - update to 1.9.0
QRadar Suite - update to 1.10.17.0
golang-1.11 (Debian package) - update to 1.11.6-1+deb10u4
buildah (Red Hat package) - update to 1.11.6-9.rhaos4.5.el8
go (Alpine package) - update to 1.15-r0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.0.10
apb (Red Hat package) - update to 2.0.3-3.el7
servicemesh-prometheus (Red Hat package) - update to 2.14.0-20.el8
openshift-ansible (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.0.2755c9b.el7, 4.5.0-202010081312.p0.git.0.401534e.el7, 4.5.0-202011121956.p0.git.0.7093c82.el7, 4.6.0-202103192141.p0.git.0.d1b612b.el7, 4.7.0-202104250659.p0.git.e1b19c2.el7
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.15.d3ab88f.el7, 4.5.0-202010081312.p0.git.15.d7814b2.el7, 4.5.0-202011121956.p0.git.15.cccc412.el7, 4.7.0-202104260636.p0.git.330c6ef.el8
atomic-enterprise-service-catalog (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.1806.53dc206.el7, 4.5.0-202010081312.p0.git.1808.498e523.el7, 4.5.0-202011121956.p0.git.1808.0eb4933.el7
machine-config-daemon (Red Hat package) - addressed in versions 4.5.0-202010012007.p0.git.2570.fc7c941.el8, 4.5.0-202012050338.p0.git.2581.e7a62a7.el8
openshift-clients (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.3445.6937a03.el7, 4.4.0-202011122017.p0.git.3445.6937a03.el8, 4.5.0-202010081312.p0.git.3607.908b350.el7, 4.5.0-202010081312.p0.git.3607.908b350.el8, 4.5.0-202011121956.p0.git.3609.b4952c1.el7, 4.5.0-202011121956.p0.git.3609.b4952c1.el8, 4.6.0-202103200039.p0.git.3841.3e951a5.el7, 4.6.0-202103200039.p0.git.3841.3e951a5.el8, 4.7.0-202104250659.p0.git.95881af.el7, 4.7.0-202104250659.p0.git.95881af.el8
openshift-kuryr (Red Hat package) - addressed in versions 4.5.0-202010091010.p0.git.1998.b73d461.el8, 4.5.0-202012022006.p0.git.2002.19b85d0.el8, 4.6.0-202103192141.p0.git.2234.cba9525.el8, 4.7.0-202104250659.p0.git.d49acc4.el8
Red Hat OpenShift Container Platform - addressed in versions 4.4.31, 4.5.20, 4.5.23, 4.5.34, 4.5.37, 4.6.6, 4.6.23, 4.7.9, 4.7.13
openshift (Red Hat package) - addressed in versions 4.4.0-202011130111.p0.git.0.4861dfa.el7, 4.4.0-202011130111.p0.git.0.4861dfa.el8, 4.5.0-202010091010.p0.git.0.3538ccc.el7, 4.5.0-202010091010.p0.git.0.3538ccc.el8, 4.5.0-202011131403.p0.git.0.d153f8f.el7, 4.5.0-202011131403.p0.git.0.d153f8f.el8, 4.5.0-202012040353.p0.git.0.c2c4083.el7, 4.5.0-202012040353.p0.git.0.c2c4083.el8, 4.5.0-202102261511.p0.git.0.f0229b9.el7, 4.5.0-202102261511.p0.git.0.f0229b9.el8, 4.6.0-202103210832.p0.git.94284.834ccc7.el7, 4.6.0-202103210832.p0.git.94284.834ccc7.el8, 4.7.0-202104250659.p0.git.7d0a2b2.el7, 4.7.0-202104250659.p0.git.7d0a2b2.el8
jenkins-2-plugins (Red Hat package) - update to 4.7.1621361158-1.el8
OpenShift Logging - update to 5.0.3
servicemesh-grafana (Red Hat package) - update to 6.4.3-19.el8
IBM Robotic Process Automation - update to 21.0.3.1
golang-1.13-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.1, 1.13.8-1ubuntu1~18.04.4, 1.13.8-1ubuntu2.22.04.1, 1.13.8-1ubuntu2.22.10.1
golang-1.13 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.1, 1.13.8-1ubuntu1~18.04.4, 1.13.8-1ubuntu2.22.04.1, 1.13.8-1ubuntu2.22.10.1
golang-1.13-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.1, 1.13.8-1ubuntu1~18.04.4, 1.13.8-1ubuntu2.22.04.1, 1.13.8-1ubuntu2.22.10.1
golang-github-ulikunitz-xz - addressed in versions 0.5.8-1.fc31, 0.5.8-1.fc32
tini (Red Hat package) - update to 0.18.0-5.el8
skopeo (Red Hat package) - update to 1.1.1-2.rhaos4.5.el8
Netcool Operations Insight - update to 1.6.6
go-toolset-1.13 (Red Hat package) - update to 1.13.15-1.el7
golang - addressed in versions 1.13.15-1.fc31, 1.14.7-1.fc32, 1.15-1.el6, 1.15-1.el7
go-toolset-1.13-golang (Red Hat package) - update to 1.13.15-3.el7
OpenShift Virtualization - addressed in versions 2.4.2, 4.9.0
IBM Cloud Pak for Watson AIOps - update to 4.4.0
kubefed-client (Red Hat package) - update to 4.5.0-202002271711.git.2.3bd46d6.el7
mcg (Red Hat package) - update to 5.6.0-39.2279a46.5.6.el8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
redhat-release-coreos (Red Hat package) - update to 47.83-2.el8

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html
• https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q
• https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo

• OpenSUSE Linux update for go1.13
• OpenSUSE Linux update for go1.13
• Denial of service in GOland Go fro del
• Infinite loop in go (Alpine package)
• OpenSUSE Linux update for go1.14
• OpenSUSE Linux update for go1.14
• Red Hat Developer Tools update for go-toolset-1.13 and go-toolset-1.13-golang
• Amazon Linux AMI update for golang
• RHBA-2020:4229 - Bug Fix Advisory
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Red Hat OpenShift Container Platform update for golang
• Red Hat OpenShift Container Platform 4.6 update for faq
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Red Hat OpenShift Container Storage 4 update for mcg
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh
• Multiple vulnerabilities in OpenShift Serverless
• Debian update for golang-1.11
• Multiple vulnerabilities in OpenShift Container Platform 4.5
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Openshift Logging
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in OpenShift Container Platform
• Red Hat OpenShift Virtualization update for golang
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Ubuntu update for golang-1.13
• Multiple vulnerabilities in Netcool Operations Insight
• Infinite loop in IBM Cloud Automation Manager
• Ubuntu update for golang-1.13
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.5 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in OpenShift Virtualization 2.4
• Fedora 32 update for golang-github-ulikunitz-xz
• Fedora 31 update for golang-github-ulikunitz-xz
• Fedora EPEL 7 update for golang
• Fedora EPEL 6 update for golang
• Fedora 32 update for golang
• Fedora 31 update for golang
• Multiple vulnerabilities in Dell ObjectScale