xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xz | Xz_project | * | 0.5.8 (excluding) |
| Golang-github-ulikunitz-xz | Ubuntu | groovy | * |
| Golang-github-ulikunitz-xz | Ubuntu | hirsute | * |
| Golang-github-ulikunitz-xz | Ubuntu | impish | * |
| Golang-github-ulikunitz-xz | Ubuntu | kinetic | * |
| Golang-github-ulikunitz-xz | Ubuntu | lunar | * |
| Golang-github-ulikunitz-xz | Ubuntu | mantic | * |
| Golang-github-ulikunitz-xz | Ubuntu | trusty | * |
| OADP-1.0-RHEL-8 | RedHat | oadp/oadp-velero-plugin-rhel8:1.0.1-5 | * |
| OpenShift Service Mesh 2.0 | RedHat | servicemesh-0:2.0.9-3.el8 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | RedHat | rhacm2/cluster-curator-controller-rhel8:v2.3.0-41 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | RedHat | rhacm2/multicloud-manager-rhel8:v2.3.0-69 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | RedHat | rhacm2/multiclusterhub-rhel8:v2.3.0-106 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | RedHat | rhacm2/multicluster-operators-application-rhel8:v2.3.0-39 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | RedHat | rhacm2/search-collector-rhel8:v2.3.0-52 | * |
| Red Hat OpenStack Platform 16.2 | RedHat | rhosp-rhel8-tech-preview/osp-director-operator:1.2.3-2 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/kubernetes-nmstate-handler-rhel8:v4.8.0-21 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/kubevirt-v2v-conversion:v4.8.0-10 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/kubevirt-vmware:v4.8.0-11 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/node-maintenance-operator:v4.8.0-19 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/vm-import-controller:v4.8.0-18 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/vm-import-controller-rhel8:v4.8.0-18 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/vm-import-operator-rhel8:v4.8.0-18 | * |
| RHEL-8-CNV-4.8 | RedHat | container-native-virtualization/vm-import-virtv2v-rhel8:v4.8.0-18 | * |