VDB
RHSA-2020%3A3780
RHSA-2020%3A3780
PUBLISHED
CVSS 7.5 HIGH
A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-cluster-svcat-apiserver-operator@sha256:032aba06e045c1514580674e41047f82af8db63c1be171aed886c137c582d052_amd64 as a component of Red Hat OpenShift Container Platform 4.5 | * |
| Red Hat | openshift4/ose-cluster-svcat-apiserver-operator@sha256:16689dfc4918f8fcf5a73a7bbd7c3888f836fbecc820eb3575d474a59d4e18bf_s390x as a component of Red Hat OpenShift Container Platform 4.5 | openshift4/ose-cluster-svcat-apiserver-operator@sha256:16689dfc4918f8fcf5a73a7bbd7c3888f836fbecc820eb3575d474a59d4e18bf_s390x, * |
| Red Hat | openshift4/ose-cluster-svcat-apiserver-operator@sha256:62cbc44bdcde5a17f8f0ac60821d2eedd002fb6479e21443d5ce0adb972b9455_ppc64le as a component of Red Hat OpenShift Container Platform 4.5 | openshift4/ose-cluster-svcat-apiserver-operator@sha256:62cbc44bdcde5a17f8f0ac60821d2eedd002fb6479e21443d5ce0adb972b9455_ppc64le, * |
| Red Hat | openshift4/ose-cluster-svcat-apiserver-operator@sha256:62cbc44bdcde5a17f8f0ac60821d2eedd002fb6479e21443d5ce0adb972b9455_ppc64le as a component of Red Hat OpenShift Container Platform 4.5 | openshift4/ose-cluster-svcat-apiserver-operator@sha256:62cbc44bdcde5a17f8f0ac60821d2eedd002fb6479e21443d5ce0adb972b9455_ppc64le |
| Red Hat | openshift4/ose-cluster-svcat-apiserver-operator@sha256:032aba06e045c1514580674e41047f82af8db63c1be171aed886c137c582d052_amd64 as a component of Red Hat OpenShift Container Platform 4.5 | openshift4/ose-cluster-svcat-apiserver-operator@sha256:032aba06e045c1514580674e41047f82af8db63c1be171aed886c137c582d052_amd64, * |
| golang.org | x/text | |
| Red Hat | openshift4/ose-cluster-svcat-apiserver-operator@sha256:16689dfc4918f8fcf5a73a7bbd7c3888f836fbecc820eb3575d474a59d4e18bf_s390x as a component of Red Hat OpenShift Container Platform 4.5 | * |
Timeline
- Sep 21, 2020 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 4, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2020:3780 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1853652 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3780.json advisory
- https://access.redhat.com/security/cve/CVE-2020-14040 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-14040 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-14040 advisory
- https://github.com/golang/go/issues/39491 advisory
- https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 advisory