CVE-2020-29510
No fix known EPSS 2%CVSS 9.8
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Products: Golang Go
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:11 | golang-1.15 | no fix |
| Ubuntu:14.04:LTS | golang-1.10 | no fix |
| Ubuntu:16.04:LTS | golang-1.10 | no fix |
| Ubuntu:16.04:LTS | golang-1.6 | no fix |
| Ubuntu:18.04:LTS | golang-1.10 | no fix |
| Ubuntu:18.04:LTS | golang-1.8 | no fix |
| Ubuntu:18.04:LTS | golang-1.9 | no fix |
| Ubuntu:20.04:LTS | golang-1.13 | no fix |
| Ubuntu:20.04:LTS | golang-1.14 | no fix |
| Ubuntu:Pro:16.04:LTS | golang-1.13 | no fix |
| Ubuntu:Pro:18.04:LTS | golang-1.13 | no fix |
| Ubuntu:Pro:22.04:LTS | golang-1.13 | no fix |