CVE-2020-29510

描述

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

如何修補 CVE-2020-29510

要修補 CVE-2020-29510,請將受影響套件升級到下列已修補版本。

• Bitnami/golang—升級至 1.15.1 或更新版本
• —未列出修補版本

CVE-2020-29510 正在被利用嗎?

低 — EPSS 為 2.0%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 1.15.1
• from 0

CVSS 分數

參考連結(4)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-29510
• WEBgithub.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
• WEBnvd.nist.gov/vuln/detail/CVE-2020-29510
• WEBsecurity.netapp.com/advisory/ntap-20210129-0006/