Bug 1180024 (CVE-2020-29511)

Summary: VUL-0: CVE-2020-29511: go1.14,go1.15: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behav
Product: [Novell Products] SUSE Security Incidents Reporter: Marcus Meissner <meissner>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED WONTFIX QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P3 - Medium CC: smash_bz, wolfgang.frisch
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/273375/
Whiteboard: CVSSv3.1:SUSE:CVE-2020-29511:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Marcus Meissner 2020-12-15 06:48:18 UTC
CVE-2020-29511

The encoding/xml package in Go (all versions) does not correctly preserve the
semantics of element namespace prefixes during tokenization round-trips, which
allows an attacker to craft inputs that behave in conflicting ways during
different stages of processing in affected downstream applications.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-29511
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29511
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
Comment 1 Wolfgang Frisch 2021-01-20 09:49:18 UTC
Upstream golang declared this bug as WONTFIX [1].
Affected users can workaround the vulnerability by using Mattermost's xml-roundtrip-validator [2].

[1] https://github.com/golang/go/issues/43168
[2] https://github.com/mattermost/xml-roundtrip-validator