9.8
Critique
CVE-2020-29510 The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives…
Description
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Go 1.15 | premières → 1.15 | Pas de correctif indiqué |
Références
- github.com github.com
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Go
Les 7 CVE de Go →
CVE-2024-24789
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip…
5.3
Moyenne
CVE-2024-24790
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning…
9.8
Critique
CVE-2024-24787
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version…
6.4
Moyenne
CVE-2023-45284
On Windows, The IsLocal function does not correctly detect reserved device names in some cases
5.3
Moyenne