CVE-2020-28362 Panic during division of very large numbers in math/big
HighCVSS 7.5
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stdlib(Go) | >= 1.14.0-0, < 1.14.12 | 1.14.12 |
| stdlib(Go) | >= 1.15.0-0, < 1.15.5 | 1.15.5 |
| debian/golang-1.15(Debian:11) | < 1.15.5-1 | 1.15.5-1 |
| golang go | < 1.14.12 | 1.14.12 |
| golang go | >= 1.15, < 1.15.5 | 1.15.5 |
| fedoraproject fedora | = 32 | No fix listed |
| fedoraproject fedora | = 33 | No fix listed |
| netapp cloud insights telegraf agent | All versions | No fix listed |
| netapp Trident | All versions | No fix listed |
| alpine/go(Alpine:v3.13) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.14) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.15) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.16) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.17) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.18) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.19) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.20) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.21) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.22) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.23) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.24) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
References
- go.dev patch
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- security-tracker.debian.org vendor-advisory
- groups.google.com release-notes third-party-advisory
- [trafficcontrol-issues] 20201112 [GitHub] [trafficcontrol] zrhoffman opened a new pull request #5278: Update Go version to 1.15.5 mailing-list
- FEDORA-2020-e971480183 vendor-advisory
- FEDORA-2020-864922e78a vendor-advisory
- security.netapp.com third-party-advisory
- www.arista.com third-party-advisory
- security.alpinelinux.org vendor-advisory