by Kastro
Paper/Archive/CVE-2020-29509

CVE-2020-29509

Golang Go — The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenizati…

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.7.817 × 2016.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Affected

ProductAffectedFixed inSource
GoAll versions–CNA

Scores by source

Mattermost (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.mdrefsecurity.netapp.com/advisory/ntap-20210129-0006