VDB
RHSA-2020%3A3087
RHSA-2020%3A3087
PUBLISHED
CVSS 7.5 HIGH
A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | distributed-tracing/jaeger-ingester-rhel7@sha256:5cff6ba93d6e5a8f6853b7a5469be451383a193e85bb0505b74c94f6e50cacd9_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | *, * |
| Red Hat | distributed-tracing/jaeger-ingester-rhel7@sha256:5cff6ba93d6e5a8f6853b7a5469be451383a193e85bb0505b74c94f6e50cacd9_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-ingester-rhel7@sha256:5cff6ba93d6e5a8f6853b7a5469be451383a193e85bb0505b74c94f6e50cacd9_amd64 |
| Red Hat | distributed-tracing/jaeger-all-in-one-rhel7@sha256:4fa3cf137dc82aea05cf970d795f6bedd213513a114b284339299eb008ad50ad_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-all-in-one-rhel7@sha256:4fa3cf137dc82aea05cf970d795f6bedd213513a114b284339299eb008ad50ad_amd64, * |
| Red Hat | distributed-tracing/jaeger-agent-rhel7@sha256:6d6dfb8843465fedfaa5bc73d8b1ef0fe7d39f3e0bcb95508277ecc5bee56a15_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-agent-rhel7@sha256:6d6dfb8843465fedfaa5bc73d8b1ef0fe7d39f3e0bcb95508277ecc5bee56a15_amd64 |
| Red Hat | distributed-tracing/jaeger-query-rhel7@sha256:2a7f0915d6838ee858562a867fa57260df03704ee98b278839a731a42ace4db6_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | *, distributed-tracing/jaeger-query-rhel7@sha256:2a7f0915d6838ee858562a867fa57260df03704ee98b278839a731a42ace4db6_amd64 |
| Red Hat | distributed-tracing/jaeger-rhel7-operator@sha256:730e0015fdeab7b9ede059a1c685e003aa33463319690375c91daa22f2830428_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-rhel7-operator@sha256:730e0015fdeab7b9ede059a1c685e003aa33463319690375c91daa22f2830428_amd64 |
| Red Hat | distributed-tracing/jaeger-agent-rhel7@sha256:6d6dfb8843465fedfaa5bc73d8b1ef0fe7d39f3e0bcb95508277ecc5bee56a15_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | *, distributed-tracing/jaeger-agent-rhel7@sha256:6d6dfb8843465fedfaa5bc73d8b1ef0fe7d39f3e0bcb95508277ecc5bee56a15_amd64 |
| Red Hat | distributed-tracing/jaeger-query-rhel7@sha256:2a7f0915d6838ee858562a867fa57260df03704ee98b278839a731a42ace4db6_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-query-rhel7@sha256:2a7f0915d6838ee858562a867fa57260df03704ee98b278839a731a42ace4db6_amd64 |
| Red Hat | distributed-tracing/jaeger-all-in-one-rhel7@sha256:4fa3cf137dc82aea05cf970d795f6bedd213513a114b284339299eb008ad50ad_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-all-in-one-rhel7@sha256:4fa3cf137dc82aea05cf970d795f6bedd213513a114b284339299eb008ad50ad_amd64 |
| Red Hat | distributed-tracing/jaeger-collector-rhel7@sha256:27be7095512eab0638ec5ec06670fd5404922884fc7bcbede92a320ab821ec09_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | *, * |
| Red Hat | distributed-tracing/jaeger-collector-rhel7@sha256:27be7095512eab0638ec5ec06670fd5404922884fc7bcbede92a320ab821ec09_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | * |
| Red Hat | distributed-tracing/jaeger-query-rhel7 | |
| Red Hat | distributed-tracing/jaeger-rhel7-operator@sha256:730e0015fdeab7b9ede059a1c685e003aa33463319690375c91daa22f2830428_amd64 as a component of Red Hat OpenShift Jaeger 1.17 | distributed-tracing/jaeger-rhel7-operator@sha256:730e0015fdeab7b9ede059a1c685e003aa33463319690375c91daa22f2830428_amd64, * |
Timeline
- Jul 22, 2020 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 4, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2020:3087 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1853652 issue
- https://issues.redhat.com/browse/TRACING-1300 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3087.json advisory
- https://access.redhat.com/security/cve/CVE-2020-14040 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-14040 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-14040 advisory
- https://github.com/golang/go/issues/39491 advisory
- https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 advisory