CVE-2020-28362 : Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Published 2020-11-18 17:15:12

Updated 2021-11-30 22:07:29

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2020-28362

Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Netapp » Trident » Version: N/A
cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:*
Matching versions
Netapp » Cloud Insights Telegraf Agent » Version: N/A
cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:*
Matching versions
Golang » GO
Versions from including (>=) 1.15 and before (<) 1.15.5
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Matching versions
Golang » GO
Versions before (<) 1.14.12
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.53%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

https://security.netapp.com/advisory/ntap-20201202-0004/

November 2020 Golang Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP/

[SECURITY] Fedora 32 Update: golang-1.14.13-1.fc32 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO/

[SECURITY] Fedora 33 Update: golang-1.15.5-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd@%3Cissues.trafficcontrol.apache.org%3E

[GitHub] [trafficcontrol] zrhoffman opened a new pull request #5278: Update Go version to 1.15.5 - Pony Mail
Mailing List;Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/12166-security-advisory-62

Security Advisory 0062 - Arista
Third Party Advisory
https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI

[security] Go 1.15.5 and Go 1.14.12 are released
Release Notes;Third Party Advisory

Jump to