ID CVE-2020-28851
Summary In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
References
Vulnerable Configurations
  • cpe:2.3:a:golang:go:1.15.4:*:*:*:*:*:*:*
    cpe:2.3:a:golang:go:1.15.4:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 22-02-2021 - 19:14)
Impact:
Exploitability:
CWE CWE-129
CAPEC
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
refmap via4
misc https://github.com/golang/go/issues/42535
Last major update 22-02-2021 - 19:14
Published 02-01-2021 - 06:15
Last modified 22-02-2021 - 19:14
Back to Top