CVE-2020-29511
Fixed in a distro release EPSS 2%CVSS 9.8
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Products: Golang Go
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | go-1.19 | 0 |
| Chainguard | go-1.19-doc | 0 |
| Chainguard | go-1.20 | 0 |
| Chainguard | go-1.20-doc | 0 |
| Chainguard | go-1.21 | 0 |
| Chainguard | go-1.21-doc | 0 |
| Chainguard | go-fips-1.20 | 0 |
| Chainguard | go-fips-1.20-doc | 0 |
| Debian 11 | golang-1.15 | no fix |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |
| Ubuntu 20.04 LTS | golang-1.13 | no fix |
| Ubuntu 20.04 LTS | golang-1.14 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 22.04 LTS | golang-1.13 | no fix |
| Wolfi | go-1.19 | 0 |
| Wolfi | go-1.19-doc | 0 |
| Wolfi | go-1.20 | 0 |
| Wolfi | go-1.20-doc | 0 |
| Wolfi | go-1.21 | 0 |
| Wolfi | go-1.21-doc | 0 |
| Wolfi | go-fips-1.20 | 0 |
| Wolfi | go-fips-1.20-doc | 0 |