CVE-2021-27918: High severity IBM Data Virtualization on Cloud Pak for Data vulnerability
An infinite loop vulnerability was found in golang. If an application defines a custom token parser initializing with xml.NewTokenDecoder it is possible for the parsing loop to never return. An attacker could potentially craft a malicious XML document which has an XML element with EOF within it, causing the parsing application to endlessly loop, resulting in a Denial of Service (DoS).
Other sources
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
Golang Go is vulnerable to a denial of service, caused by an infinite loop flaw when using xml.NewTokenDecoder with a custom TokenReader. By persuading a victim to open a specially-crafted XML content, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-27918?
CVE-2021-27918 is an infinite loop vulnerability found in Golang versions before 1.15.9 and 1.16.x before 1.16.1.
What is the severity of CVE-2021-27918?
CVE-2021-27918 has a severity level of high.
How does CVE-2021-27918 affect the software?
CVE-2021-27918 affects Golang versions before 1.15.9 and 1.16.x before 1.16.1, as well as certain versions of openshift-serverless-clients.
How can I fix CVE-2021-27918?
To fix CVE-2021-27918, update your Golang installation to version 1.15.9 or higher.
Where can I find more information about CVE-2021-27918?
You can find more information about CVE-2021-27918 at the following references: [CVE-2021-27918](https://www.cve.org/CVERecord?id=CVE-2021-27918), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-27918), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1937901), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2021:2705).