登录 注册
开源 企业版 高校版 私有云 模力方舟 Gitee AI
扫描微信二维码支付
取消
支付完成
Watch
不关注 关注所有动态 仅关注版本发行动态 关注但不提醒动态
13 Star 0 Fork 7

src-openEuler/buildah

代码 Issues 26 Pull Requests 0 Wiki 统计 流水线
服务
Issues
 / 详情

CVE-2020-14040

已拒绝
CVE和安全问题
openeuler-ci-bot
拥有者
创建于  
2024-08-20 11:41

一、漏洞信息
漏洞编号：CVE-2020-14040
漏洞归属组件：buildah
漏洞归属的版本：1.26.1,1.34.1
CVSS V3.0分值：
BaseScore：7.5 High
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
漏洞公开时间：2020-06-18 04:15:09
漏洞创建时间：2024-08-20 19:41:01
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2020-14040

更多参考(点击展开)
参考来源 参考链接 来源链接
cve.mitre.org https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
suse_bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1853652 https://bugzilla.suse.com/show_bug.cgi?id=1174397
suse_bugzilla http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14040 https://bugzilla.suse.com/show_bug.cgi?id=1174397
suse_bugzilla http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-14040.html https://bugzilla.suse.com/show_bug.cgi?id=1174397
suse_bugzilla https://access.redhat.com/security/cve/CVE-2020-14040 https://bugzilla.suse.com/show_bug.cgi?id=1174397
suse_bugzilla http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040 https://bugzilla.suse.com/show_bug.cgi?id=1174397
suse_bugzilla https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 https://bugzilla.suse.com/show_bug.cgi?id=1174397
redhat_bugzilla https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0?pli=1 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://go-review.googlesource.com/c/text/+/238238 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://github.com/golang/go/issues/39491 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3087 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/security/cve/cve-2020-14040 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3369 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3372 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3665 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3578 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3727 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3780 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:3783 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:4214 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:4297 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:4298 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:4694 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5054 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5055 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5056 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5149 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5198 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5606 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5605 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:0420 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5635 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2020:5633 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:0799 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:0980 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:1129 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:1168 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:1369 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:2039 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
redhat_bugzilla https://access.redhat.com/errata/RHSA-2021:3140 https://bugzilla.redhat.com/show_bug.cgi?id=1853652
ubuntu https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040 https://ubuntu.com/security/CVE-2020-14040
ubuntu https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 https://ubuntu.com/security/CVE-2020-14040
ubuntu https://ubuntu.com/security/notices/USN-5873-1 https://ubuntu.com/security/CVE-2020-14040
ubuntu https://nvd.nist.gov/vuln/detail/CVE-2020-14040 https://ubuntu.com/security/CVE-2020-14040
ubuntu https://launchpad.net/bugs/cve/CVE-2020-14040 https://ubuntu.com/security/CVE-2020-14040
ubuntu https://security-tracker.debian.org/tracker/CVE-2020-14040 https://ubuntu.com/security/CVE-2020-14040
ubuntu https://github.com/golang/go/issues/39491 https://ubuntu.com/security/CVE-2020-14040
debian https://security-tracker.debian.org/tracker/CVE-2020-14040
oracle https://www.oracle.com/security-alerts/linuxbulletinjul2020.html
anolis https://anas.openanolis.cn/cves/detail/CVE-2020-14040
cve_search https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
cve_search https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
github_advisory https://nvd.nist.gov/vuln/detail/CVE-2020-14040 https://github.com/advisories/GHSA-5rcv-m4m3-hfh7
github_advisory https://github.com/golang/go/issues/39491 https://github.com/advisories/GHSA-5rcv-m4m3-hfh7
github_advisory https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/ https://github.com/advisories/GHSA-5rcv-m4m3-hfh7
github_advisory https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0 https://github.com/advisories/GHSA-5rcv-m4m3-hfh7
github_advisory https://go-review.googlesource.com/c/text/+/238238 https://github.com/advisories/GHSA-5rcv-m4m3-hfh7
github_advisory https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 https://github.com/advisories/GHSA-5rcv-m4m3-hfh7
github_advisory https://github.com/golang/text/commit/23ae387dee1f90d29a23c0e87ee0b46038fbed0e https://github.com/advisories/GHSA-5rcv-m4m3-hfh7
go https://go.dev/cl/238238 https://github.com/golang/vulndb/blob/master/reports/GO-2020-0015.yaml
go https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e https://github.com/golang/vulndb/blob/master/reports/GO-2020-0015.yaml
go https://go.dev/issue/39491 https://github.com/golang/vulndb/blob/master/reports/GO-2020-0015.yaml
go https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0 https://github.com/golang/vulndb/blob/master/reports/GO-2020-0015.yaml
osv https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 https://osv.dev/vulnerability/CVE-2020-14040
osv https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/ https://osv.dev/vulnerability/CVE-2020-14040
amazon_linux_explore https://access.redhat.com/security/cve/CVE-2020-14040 https://explore.alas.aws.amazon.com/CVE-2020-14040.html
amazon_linux_explore https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040 https://explore.alas.aws.amazon.com/CVE-2020-14040.html

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)
影响的包 修复版本 修复补丁 问题引入补丁 来源
https://github.com/golang/text/commit/23ae387dee1f90d29a23c0e87ee0b46038fbed0e github_advisory
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0 nvd
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/ nvd
golang-golang-x-text https://github.com/golang/text/commit/23ae387dee1f ubuntu

二、漏洞分析结构反馈
影响性分析说明：

openEuler评分：
7.5
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(1.34.1):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP1:
4.openEuler-22.03-LTS-SP3(1.26.1):
5.openEuler-22.03-LTS-SP4:
6.openEuler-24.03-LTS(1.34.1):
7.openEuler-24.03-LTS-Next(1.34.1):

修复是否涉及abi变化(是/否)：
1.master(1.34.1):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP1:
4.openEuler-22.03-LTS-SP3(1.26.1):
5.openEuler-22.03-LTS-SP4:
6.openEuler-24.03-LTS(1.34.1):
7.openEuler-24.03-LTS-Next(1.34.1):

评论 (5)

5329419 openeuler ci bot 1632792936
openeuler-ci-bot 创建了CVE和安全问题 8个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 添加了
 
CVE/UNFIXED
标签 8个月前
展开全部操作日志
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 添加了
 
sig/sig-CloudNative
标签 8个月前
参考网址 关联pr 状态 补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
https://ubuntu.com/security/CVE-2020-14040NoneNonehttps://github.com/golang/text/commit/23ae387dee1f
https://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2020-14040
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14040NoneNonehttps://go-review.googlesource.com/c/text
https://groups.google.com/g/golang-announce/c/b
https://security-tracker.debian.org/tracker/CVE-2020-14040https://github.com/cybozu-go/neco/issues/1017None
https://github.com/tektoncd/pipeline/pull/2929closedhttps://github.com/tektoncd/pipeline/commit/c2253ef0dc57e221a0819737cf9b5022ba90f086
https://github.com/tektoncd/triggers/pull/674closedhttps://github.com/tektoncd/triggers/commit/19965d6db8bb07a934320c361074488201119bed
https://github.com/tektoncd/cli/pull/1064closedhttps://github.com/tektoncd/cli/commit/8f172ec50546726161801552440cda4c83360f49
https://github.com/tektoncd/operator/pull/113closedhttps://github.com/tektoncd/operator/commit/af0b6a2f8254867176ac1af6632752a0137fb0ab
https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/157closedhttps://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/618322410fbf93c36a73a117fee7a2ce307b4830
https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/23closedhttps://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/8b33b6a5f3764d1f2c4f628bf2d9a409436498ae
https://github.com/spf13/afero/pull/254closedhttps://github.com/spf13/afero/commit/7686d4fd588886834bae5492ef22e206a06e56cf
https://github.com/operator-framework/operator-lifecycle-manager/pull/1718closedhttps://github.com/operator-framework/operator-lifecycle-manager/commit/9837b9cedfe7d411bda059f8ab29f60640d73125
https://github.com/operator-framework/operator-lifecycle-manager/pull/1719closedhttps://github.com/operator-framework/operator-lifecycle-manager/commit/9837b9cedfe7d411bda059f8ab29f60640d73125
https://github.com/Azure/azure-storage-azcopy/issues/1246None
https://github.com/rhysd/go-github-selfupdate/pull/38closedhttps://github.com/rhysd/go-github-selfupdate/commit/f315b89e29dad7adc87431caf33742fa86b6daf8
https://github.com/stolostron/multiclusterhub-repo/pull/363closedhttps://github.com/stolostron/multiclusterhub-repo/commit/b40759fd678f6f1df1ed2068e14d1b4841080172
https://github.com/stolostron/multiclusterhub-repo/commit/01220b1218f315b155c677ca9f94fc05cb10a6a4
https://github.com/k8snetworkplumbingwg/rdma-cni/pull/41closedhttps://github.com/k8snetworkplumbingwg/rdma-cni/commit/20f84f03ae2db55c5abb990577678a6b327566a5

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 8个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将计划开始日期设置为2024-08-21 8个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将计划截止日期设置为2024-09-04 8个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将优先级设置为主要 8个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 8个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 8个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将负责人设置为haozi007 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前

/reason buildah 使用的 x/text 组件版本已修复此漏洞，不受影响。
5420022 jianminw 1736235438
Jianmin 移除了
 
CVE/UNFIXED
标签 4个月前
5420022 jianminw 1736235438
Jianmin 添加了
 
CVE/UNAFFECTED
标签 4个月前
5420022 jianminw 1736235438
Jianmin 将任务状态从 Backlog 修改为Declined 4个月前
issue状态 操作者 原因
已拒绝 jianminw buildah 使用的 x/text 组件版本已修复此漏洞，不受影响。

登录 后才可以发表评论

状态
负责人
项目
未立项任务
未立项任务
Pull Requests
未关联
未关联
关联的 Pull Requests 被合并后可能会关闭此 issue
预计工期 （小时）
开始日期   -   截止日期
-
置顶选项
不置顶
不置顶
置顶等级：高
置顶等级：中
置顶等级：低
优先级
主要
不指定
严重
主要
次要
不重要
标签
sig/sig-CloudNative
CVE/UNAFFECTED
里程碑
未关联里程碑
未关联里程碑
分支
未关联
分支 (12)
标签 (8)
master
openEuler-25.03
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-Next
openEuler-24.03-LTS-SP2
openEuler-24.03-LTS
openEuler-22.03-LTS-SP4
openEuler-22.03-LTS-Next
openEuler-24.09
openEuler-22.03-LTS
openEuler-22.03-LTS-SP3
openEuler-23.09
openEuler-25.03-release
openEuler-24.03-LTS-update-20250117
openEuler-24.03-LTS-SP1-update-20250117
openEuler-24.03-LTS-SP1-release
openEuler-22.03-LTS-SP4-release
openEuler-24.09-release
openEuler-24.03-LTS-release
openEuler-23.09-rc5
参与者（2）
5329419 openeuler ci bot 1632792936 5420022 jianminw 1736235438
1
https://gitee.com/src-openeuler/buildah.git
git@gitee.com:src-openeuler/buildah.git
src-openeuler
buildah
buildah
点此查找更多帮助

搜索帮助

Git 命令在线学习 如何在 Gitee 导入 GitHub 仓库
Git 仓库基础操作
企业版和社区版功能对比
SSH 公钥设置
如何处理代码冲突
仓库体积过大，如何减小？
如何找回被删除的仓库数据
Gitee 产品配额说明
GitHub仓库快速导入Gitee及同步更新
什么是 Release（发行版）
将 PHP 项目自动发布到 packagist.org
仓库举报
回到顶部