vulnwire
7.5high

CVE-2020-28362

Panic during division of very large numbers in math/big

Also known as GO-2021-0069

Published 5 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.9%
percentile 90%
Public exploits
0
none known

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Exploit prediction (EPSS)

3.86% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected packages

EcosystemPackageAffectedFixed in
gostdlib
>=1.14.0-0, <1.14.12
>=1.15.0-0, <1.15.5
1.14.12
1.15.5

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

  • lists.apache.org /thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd%40%3Cissues.traffic · mailing-list, x_refsource_MLIST, x_transferred
  • groups.google.com /g/golang-nuts/c/c-ssaaS7RMI · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQ · vendor-advisory, x_refsource_FEDORA, x_transferred
  • security.netapp.com /advisory/ntap-20201202-0004/ · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBD · vendor-advisory, x_refsource_FEDORA, x_transferred
  • arista.com /en/support/advisories-notices/security-advisories/12166-security-advisory-62 · x_refsource_MISC, x_transferred
  • go.dev /cl/269657 · fix
  • go.googlesource.com /go/+/1e1fa5903b760c6714ba17e50bf850b01f49135c · fix
  • go.dev /issue/42552 · report
  • groups.google.com /g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.