svn commit: r544282 - head/security/vuxml
Dmitri Goutnik
dmgk at FreeBSD.org
Thu Aug 6 17:22:22 UTC 2020
Author: dmgk
Date: Thu Aug 6 17:22:21 2020
New Revision: 544282
URL: https://svnweb.freebsd.org/changeset/ports/544282
Log:
security/vuxml: Document lang/go vulnerability
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Thu Aug 6 15:48:15 2020 (r544281)
+++ head/security/vuxml/vuln.xml Thu Aug 6 17:22:21 2020 (r544282)
@@ -58,6 +58,38 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="bc7aff8c-d806-11ea-a5aa-0800272260e5">
+ <topic>go -- encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs</topic>
+ <affects>
+ <package>
+ <name>go</name>
+ <range><lt>1.14.7,1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Go project reports:</p>
+ <blockquote cite="https://github.com/golang/go/issues/40618">
+ <p>Certain invalid inputs to ReadUvarint or ReadVarint could cause
+ those functions to read an unlimited number of bytes from the
+ ByteReader argument before returning an error. This could lead to
+ processing more input than expected when the caller is reading
+ directly from the network and depends on ReadUvarint and ReadVarint
+ only consuming a small, bounded number of bytes, even from invalid
+ inputs.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2020-16845</cvename>
+ <url>https://github.com/golang/go/issues/40618</url>
+ </references>
+ <dates>
+ <discovery>2020-08-06</discovery>
+ <entry>2020-08-06</entry>
+ </dates>
+ </vuln>
+
<vuln vid="a003b74f-d7b3-11ea-9df1-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
More information about the svn-ports-head
mailing list