CVE-2020-29509
Fixed in a distro release EPSS 2%CVSS 9.8
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Products: Golang Go
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/russellhaering/gosaml2 | 0.6.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | go-1.19 | 0 |
| Chainguard | go-1.19-doc | 0 |
| Chainguard | go-1.20 | 0 |
| Chainguard | go-1.20-doc | 0 |
| Chainguard | go-1.21 | 0 |
| Chainguard | go-1.21-doc | 0 |
| Chainguard | go-fips-1.20 | 0 |
| Chainguard | go-fips-1.20-doc | 0 |
| Debian:11 | golang-1.15 | no fix |
| Ubuntu:14.04:LTS | golang-1.10 | no fix |
| Ubuntu:16.04:LTS | golang-1.10 | no fix |
| Ubuntu:16.04:LTS | golang-1.6 | no fix |
| Ubuntu:18.04:LTS | golang-1.10 | no fix |
| Ubuntu:18.04:LTS | golang-1.8 | no fix |
| Ubuntu:18.04:LTS | golang-1.9 | no fix |
| Ubuntu:20.04:LTS | golang-1.13 | no fix |
| Ubuntu:20.04:LTS | golang-1.14 | no fix |
| Ubuntu:Pro:16.04:LTS | golang-1.13 | no fix |
| Ubuntu:Pro:18.04:LTS | golang-1.13 | no fix |
| Ubuntu:Pro:22.04:LTS | golang-1.13 | no fix |
| Wolfi | go-1.19 | 0 |
| Wolfi | go-1.19-doc | 0 |
| Wolfi | go-1.20 | 0 |
| Wolfi | go-1.20-doc | 0 |
| Wolfi | go-1.21 | 0 |
| Wolfi | go-1.21-doc | 0 |
| Wolfi | go-fips-1.20 | 0 |
| Wolfi | go-fips-1.20-doc | 0 |