CVE-2021-29482 — Infinite Loop in XZ

CWE-835 — Infinite Loop8 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 37.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Ulikunitz XZGithub.com Ulikunitz XZXZ Project XZ
Timeline
PublishedApr 28
Latest updateMay 25

Description

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5ulikunitz/xz< 0.5.8
▶NVDxz_project/xz< 0.5.8

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)↗2021-05-25
▶
OSV
github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)↗2021-05-25
▶
OSV
CVE-2021-29482: xz is a compression and decompression library focusing on the xz format completely written in Go↗2021-04-28
▶
CVEList
denial of service in github.com/ulikunitz/xz↗2021-04-28
▶
OSV
Infinite loop in github.com/ulikunitz/xz↗2021-04-14
▶

📋Vendor Advisories

2
Debian
CVE-2021-29482: golang-github-ulikunitz-xz - xz is a compression and decompression library focusing on the xz format complete...↗2021
▶
Red Hat
ulikunitz/xz: Infinite loop in readUvarint allows for denial of service↗2020-08-19
▶
CVE-2021-29482 — Infinite Loop in Ulikunitz XZ | cvebase