The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Weakness
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | * | 1.17 (excluding) |
| Golang | Ubuntu | trusty | * |
| Golang-1.10 | Ubuntu | bionic | * |
| Golang-1.10 | Ubuntu | esm-infra/xenial | * |
| Golang-1.10 | Ubuntu | trusty | * |
| Golang-1.10 | Ubuntu | trusty/esm | * |
| Golang-1.10 | Ubuntu | xenial | * |
| Golang-1.13 | Ubuntu | bionic | * |
| Golang-1.13 | Ubuntu | esm-apps/xenial | * |
| Golang-1.13 | Ubuntu | focal | * |
| Golang-1.13 | Ubuntu | groovy | * |
| Golang-1.13 | Ubuntu | hirsute | * |
| Golang-1.13 | Ubuntu | impish | * |
| Golang-1.13 | Ubuntu | kinetic | * |
| Golang-1.13 | Ubuntu | xenial | * |
| Golang-1.14 | Ubuntu | focal | * |
| Golang-1.14 | Ubuntu | groovy | * |
| Golang-1.14 | Ubuntu | hirsute | * |
| Golang-1.15 | Ubuntu | groovy | * |
| Golang-1.15 | Ubuntu | hirsute | * |
| Golang-1.15 | Ubuntu | impish | * |
| Golang-1.6 | Ubuntu | esm-infra/xenial | * |
| Golang-1.6 | Ubuntu | trusty | * |
| Golang-1.6 | Ubuntu | xenial | * |
| Golang-1.8 | Ubuntu | bionic | * |
| Golang-1.9 | Ubuntu | bionic | * |
References
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
- https://security.netapp.com/advisory/ntap-20210129-0006/
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
- https://security.netapp.com/advisory/ntap-20210129-0006/