CVE-2020-16845: High severity IBM Security Guardium Insights vulnerability

Q: What is the severity of CVE-2020-16845?

The severity of CVE-2020-16845 is classified as high due to its potential to cause a denial of service.

Q: How do I fix CVE-2020-16845?

To fix CVE-2020-16845, update the Go language to versions 1.13.15, 1.14.7, or later.

Q: What products are affected by CVE-2020-16845?

CVE-2020-16845 affects multiple Go versions prior to 1.13.15 and 14.x prior to 1.14.7.

Q: Can CVE-2020-16845 be exploited remotely?

Yes, CVE-2020-16845 can be exploited remotely by sending specially-crafted input.

Q: What type of vulnerability is CVE-2020-16845?

CVE-2020-16845 is a denial of service vulnerability caused by an infinite read loop in Go's encoding/binary package.

Published Aug 6, 2020

Updated

A flaw was found in the Go encoding/binary package. Certain invalid inputs to the ReadUvarint or the ReadVarint causes those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This flaw possibly leads to processing more input than expected. The highest threat from this vulnerability is to system availability.

Other sources

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a denial of service condition.

— IBM

Affected Software

59 affected componentsFixes available

debian/golang-1.11

1.11.6-1+deb10u41.11.6-1+deb10u7

debian/golang-1.15

1.15.15-1~deb11u4

redhat/ior<0:1.1.11-2.el8

0:1.1.11-2.el8

redhat/servicemesh<0:1.1.11-2.el8

0:1.1.11-2.el8

redhat/servicemesh-cni<0:1.1.11-2.el8

0:1.1.11-2.el8

redhat/servicemesh-grafana<0:6.4.3-19.el8

0:6.4.3-19.el8

redhat/servicemesh-operator<0:1.1.11-3.el8

0:1.1.11-3.el8

redhat/servicemesh-prometheus<0:2.14.0-20.el8

0:2.14.0-20.el8

redhat/go-toolset<1.13-0:1.13.15-1.el7

1.13-0:1.13.15-1.el7

redhat/go-toolset<1.13-golang-0:1.13.15-3.el7

1.13-golang-0:1.13.15-3.el7

redhat/faq<0:0.0.6-5.el7

0:0.0.6-5.el7

redhat/openshift<0:4.4.0-202011130111.p0.git.0.4861dfa.el7

0:4.4.0-202011130111.p0.git.0.4861dfa.el7

redhat/openshift-clients<0:4.4.0-202011122017.p0.git.3445.6937a03.el7

0:4.4.0-202011122017.p0.git.3445.6937a03.el7

redhat/atomic-enterprise-service-catalog<1:4.5.0-202010081312.p0.git.1808.498e523.el7

1:4.5.0-202010081312.p0.git.1808.498e523.el7

redhat/atomic-openshift-service-idler<0:4.5.0-202010081312.p0.git.15.d7814b2.el7

0:4.5.0-202010081312.p0.git.15.d7814b2.el7

redhat/cri-o<0:1.18.4-4.rhaos4.5.git6dee389.el8

0:1.18.4-4.rhaos4.5.git6dee389.el8

redhat/apb<0:2.0.3-3.el7

0:2.0.3-3.el7

redhat/buildah<0:1.11.6-9.rhaos4.5.el8

0:1.11.6-9.rhaos4.5.el8

redhat/containernetworking-plugins<0:0.8.6-2.rhaos4.5.el8

0:0.8.6-2.rhaos4.5.el8

redhat/cri-o<0:1.18.4-7.rhaos4.5.git572d9f7.el7

0:1.18.4-7.rhaos4.5.git572d9f7.el7

redhat/cri-tools<0:1.18.0-4.el8

0:1.18.0-4.el8

redhat/golang-github-prometheus-promu<0:0.5.0-3.git642a960.el7

0:0.5.0-3.git642a960.el7

redhat/openshift<0:4.5.0-202102261511.p0.git.0.f0229b9.el8

0:4.5.0-202102261511.p0.git.0.f0229b9.el8

redhat/ignition<0:0.35.1-12.rhaos4.5.gitb4d18ad.el8

0:0.35.1-12.rhaos4.5.gitb4d18ad.el8

redhat/kubefed-client<0:4.5.0-202002271711.git.2.3bd46d6.el7

0:4.5.0-202002271711.git.2.3bd46d6.el7

redhat/openshift-eventrouter<0:0.2-5.git7c289cc.el7

0:0.2-5.git7c289cc.el7

redhat/podman<0:1.9.3-2.rhaos4.5.el8

0:1.9.3-2.rhaos4.5.el8

redhat/skopeo<1:1.1.1-2.rhaos4.5.el8

1:1.1.1-2.rhaos4.5.el8

redhat/machine-config-daemon<0:4.5.0-202012050338.p0.git.2581.e7a62a7.el8

0:4.5.0-202012050338.p0.git.2581.e7a62a7.el8

redhat/ignition<0:2.6.0-5.rhaos4.6.git947598e.el8

0:2.6.0-5.rhaos4.6.git947598e.el8

redhat/openshift<0:4.6.0-202010022112.p0.git.94033.ef41184.el7

0:4.6.0-202010022112.p0.git.94033.ef41184.el7

redhat/openshift-clients<0:4.6.0-202010081244.p0.git.3794.4743d24.el7

0:4.6.0-202010081244.p0.git.3794.4743d24.el7

redhat/podman<0:1.9.3-3.rhaos4.6.el8

0:1.9.3-3.rhaos4.6.el8

redhat/runc<0:1.0.0-81.rhaos4.6.git5b757d4.el8

0:1.0.0-81.rhaos4.6.git5b757d4.el8

redhat/faq<0:0.0.6-5.el8

0:0.0.6-5.el8

redhat/skopeo<1:1.1.1-3.rhaos4.6.el8

1:1.1.1-3.rhaos4.6.el8

redhat/openshift-eventrouter<0:0.2-6.git7c289cc.el8

0:0.2-6.git7c289cc.el8

redhat/cri-o<0:1.20.2-12.rhaos4.7.git9f7be76.el7

0:1.20.2-12.rhaos4.7.git9f7be76.el7

redhat/cri-tools<0:1.20.0-3.el7

0:1.20.0-3.el7

redhat/jenkins<2-plugins-0:4.7.1621361158-1.el8

2-plugins-0:4.7.1621361158-1.el8

redhat/redhat-release-coreos<0:47.83-2.el8

0:47.83-2.el8

redhat/golang-github-prometheus-promu<0:0.5.0-3.git642a960.el8

0:0.5.0-3.git642a960.el8

redhat/mcg<0:5.6.0-39.2279a46.5.6.el8

0:5.6.0-39.2279a46.5.6.el8

redhat/kubevirt<0:4.9.0-287.el8

0:4.9.0-287.el8

redhat/Go<1.14.7

1.14.7

redhat/Go<1.13.15

1.13.15

redhat/Go<1.15

1.15

IBM Security Guardium Insights<=2.0.2

Golang Go<1.13.15

Golang Go>=1.14<1.14.7

openSUSE Leap=15.1

openSUSE Leap=15.2

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=31

Fedoraproject Fedora=32

Microsoft azl3 python-tensorboard 2.11.0-3

Patch available

Microsoft azl3 python-tensorboard 2.16.2-2

Patch available

Microsoft cm1 golang 1.15.13-1

Patch available

Remediation

Patch Available

https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo

Event History

Aug 6, 2020

CVE Published

12:00 AM

CVE Published

via MITRE·05:03 PM

Data Sourced

via MITRE·05:03 PM

Description

Aug 7, 2020

Data Sourced

via Red Hat·11:18 AM

DescriptionSeverityAffected Software

Aug 18, 2020

Data Sourced

via Microsoft·07:00 AM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·07:00 AM

Affected Software

Updated

via Microsoft·07:00 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2020-16845?

The severity of CVE-2020-16845 is classified as high due to its potential to cause a denial of service.

How do I fix CVE-2020-16845?

To fix CVE-2020-16845, update the Go language to versions 1.13.15, 1.14.7, or later.

What products are affected by CVE-2020-16845?

CVE-2020-16845 affects multiple Go versions prior to 1.13.15 and 14.x prior to 1.14.7.

Can CVE-2020-16845 be exploited remotely?

Yes, CVE-2020-16845 can be exploited remotely by sending specially-crafted input.

What type of vulnerability is CVE-2020-16845?

CVE-2020-16845 is a denial of service vulnerability caused by an infinite read loop in Go's encoding/binary package.

CVE-2020-16845: High severity IBM Security Guardium Insights vulnerability

Other sources

Affected Software

Remediation

Patch Available

Event History

Parent advisories

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2020-16845?

How do I fix CVE-2020-16845?

What products are affected by CVE-2020-16845?

Can CVE-2020-16845 be exploited remotely?

What type of vulnerability is CVE-2020-16845?

Company

Resources

Contact