CVE-2020-28852 — Improper Validation of Array Index in Text

CWE-129 — Improper Validation of Array Index9 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 71.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Golang Text
Timeline
PublishedJan 2
Latest updateFeb 16

Description

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDgolang/text< 0.3.5

🔴Vulnerability Details

4
OSV
golang-golang-x-text, golang-x-text vulnerabilities↗2023-02-16
▶
GHSA
GHSA-5rvp-q2j7-h9rj: In x/text in Go 1↗2022-05-24
▶
CVEList
CVE-2020-28852: In x/text in Go before v0↗2021-01-02
▶
OSV
CVE-2020-28852: In x/text in Go before v0↗2021-01-02
▶

📋Vendor Advisories

4
Ubuntu
Go Text vulnerabilities↗2023-02-16
▶
Microsoft
In x/text in Go before v0.3.5 a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-↗2021-01-12
▶
Red Hat
golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag↗2021-01-02
▶
Debian
CVE-2020-28852: golang-golang-x-text - In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in lan...↗2020
▶
CVE-2020-28852 — Improper Validation of Array Index | cvebase