Input validation error in Go programming language - CVE-2020-28362

Vulnerability identifier: #VU48480

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28362

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in a number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD). A remote attacker can pass large input data to the application, specifically as divisor or modulo argument larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures).

Go programming language
Arch Linux
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
openshift-serverless-clients (Red Hat package)
servicemesh-proxy (Red Hat package)
servicemesh-cni (Red Hat package)
go (Alpine package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
runc (Red Hat package)
delve
go-toolset-1.14 (Red Hat package)
go-toolset-1.14-golang (Red Hat package)
golang
go-toolset
golang-bin
golang-race
golang-docs
golang-misc
golang-src
golang-tests
cri-tools (Red Hat package)
cri-o (Red Hat package)
servicemesh (Red Hat package)
servicemesh-operator (Red Hat package)
ignition (Red Hat package)
jenkins (Red Hat package)
openstack-ironic (Red Hat package)
Red Hat Developer Tools
ObjectScale
go-ethereum
IBM Sterling Order Management
Dell PowerProtect Cyber Recovery
Red Hat OpenShift GitOps
QRadar Suite
Red Hat OpenShift Jaeger
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Automation Manager
IBM Robotic Process Automation
Netcool Operations Insight
OpenShift Service Mesh
Red Hat OpenShift Serverless
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Go programming language - addressed in versions 1.14.12, 1.15.5
openshift-serverless-clients (Red Hat package) - update to 0.18.4-2.el8
servicemesh-proxy (Red Hat package) - update to 2.0.2-1.el8
servicemesh-cni (Red Hat package) - update to 2.0.2-2.el8
ObjectScale - update to 1.3.0
go (Alpine package) - update to 1.15.5-r0
QRadar Suite - update to 1.10.17.0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
Red Hat Advanced Cluster Management for Kubernetes - update to 2.0.10
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.7.0-202104260636.p0.git.330c6ef.el8, 4.7.0-202105111743.p0.git.39cfc66.el8
Red Hat OpenShift Container Platform - addressed in versions 4.7.9, 4.7.11, 4.7.12
openshift-kuryr (Red Hat package) - addressed in versions 4.7.0-202104250659.p0.git.d49acc4.el8, 4.7.0-202105111743.p0.git.36c2cdd.el8
openshift-ansible (Red Hat package) - addressed in versions 4.7.0-202104250659.p0.git.e1b19c2.el7, 4.7.0-202105111743.p0.git.e1b19c2.el7
openshift (Red Hat package) - addressed in versions 4.7.0-202104250659.p0.git.7d0a2b2.el7, 4.7.0-202104250659.p0.git.7d0a2b2.el8, 4.7.0-202105111743.p0.git.75370d3.el7, 4.7.0-202105111743.p0.git.75370d3.el8
openshift-clients (Red Hat package) - addressed in versions 4.7.0-202104250659.p0.git.95881af.el7, 4.7.0-202104250659.p0.git.95881af.el8, 4.7.0-202105111743.p0.git.95881af.el7, 4.7.0-202105111743.p0.git.95881af.el8
IBM Robotic Process Automation - update to 21.0.3.1
golang-github-prometheus-promu (Red Hat package) - update to 0.5.0-3.git642a960.el8
runc (Red Hat package) - addressed in versions 1.0.0-95.rhaos4.8.gitcd80260.el7, 1.0.0-95.rhaos4.8.gitcd80260.el8
delve - update to 1.5.0-2
Netcool Operations Insight - update to 1.6.6
go-ethereum - update to 1.9.24
Red Hat OpenShift Serverless - update to 1.12.0
go-toolset-1.14 (Red Hat package) - update to 1.14.12-1.el7_9
go-toolset-1.14-golang (Red Hat package) - update to 1.14.12-1.el7_9
golang - addressed in versions 1.14.13-1.fc32, 1.15.5-1.el6, 1.15.5-1.el7, 1.15.5-1.fc33
go-toolset - update to 1.15.14-1
golang - update to 1.15.14-1
golang-bin - update to 1.15.14-1
golang-race - update to 1.15.14-1
golang-docs - update to 1.15.14-1
golang-misc - update to 1.15.14-1
golang-src - update to 1.15.14-1
golang-tests - update to 1.15.14-1
cri-tools (Red Hat package) - addressed in versions 1.20.0-2.el7, 1.20.0-2.el8
cri-o (Red Hat package) - addressed in versions 1.20.2-11.rhaos4.7.git704b03d.el7, 1.20.2-11.rhaos4.7.git704b03d.el8
servicemesh (Red Hat package) - update to 2.0.2-1.el8
servicemesh-operator (Red Hat package) - update to 2.0.2-3.el8
ignition (Red Hat package) - update to 2.9.0-3.rhaos4.7.git1d56dc8.el8
jenkins (Red Hat package) - update to 2.277.3.1620393611-1.el8
IBM Sterling Order Management - update to 10.0.2403.1
openstack-ironic (Red Hat package) - update to 16.0.4-0.20210510131210.6787142.el8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

• https://github.com/golang/go/issues/42554
• https://github.com/golang/go/commit/84150d0af193a7ccd733b3c7fa5787f43125cd2d

• Multiple vulnerabilities in Go programming language
• Arch Linux update for go
• Input validation error in go (Alpine package)
• Red Hat Developer Tools update for go-toolset-1.14-golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Amazon Linux AMI update for golang
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Red Hat OpenShift Serverless Client security update
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Denial of service in Red Hat OpenShift Service Mesh 2.0 for RHEL 8
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Netcool Operations Insight
• Input validation error in IBM Cloud Automation Manager
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Anolis OS update for go-toolset:an8 module
• Fedora 33 update for golang
• Fedora EPEL 7 update for golang
• Fedora EPEL 6 update for golang
• Fedora 32 update for golang
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in go-ethereum