CVE-2020-29510

2020-12-1420:15:13

Google

osv.dev

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.1%

JSON

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

CPENameOperatorVersion
goeqgo1.8beta2
goeqweekly.2011-11-02
goeqweekly.2010-03-04
goeqweekly.2010-09-06
goeqgo1.12beta1
goeqweekly.2010-12-08
goeqgo1.11beta1
goeqweekly.2010-03-22
goeqweekly.2011-05-22
goeqgo1.6beta2

Name	Operator	Version
go	eq	go1.8beta2
go	eq	weekly.2011-11-02
go	eq	weekly.2010-03-04
go	eq	weekly.2010-09-06
go	eq	go1.12beta1
go	eq	weekly.2010-12-08
go	eq	go1.11beta1
go	eq	weekly.2010-03-22
go	eq	weekly.2011-05-22
go	eq	go1.6beta2