Read the docs
TI-2020-12850 Aliases CVE-2020-16845

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint…

Priority MEDIUM 41CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 17 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-835.

Summary

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Why it matters now

EPSS 0.04861 92nd percentileScored 2026-11-07
Fix Partial Red Hat: 20 advisoriesRed Hat: 17 fixed, 10 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.13.15; 1.14 to before 1.14.7VulnerableGo standard library
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.13.15; 1.14 to before 1.14.7 Vulnerable ·Go standard library
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject

Remediation

Red Hat 20 advisories

  • RHSA-2021:4103 Released 2021-11-02 · Red Hat rating Moderate
    OpenShift Virtualization 4.9.0 RPMs security and bug fix update
    • CNV 4.9 for RHEL 7 kubevirt-4.9.0-287.el7, kubevirt-virtctl-4.9.0-287.el7, kubevirt-virtctl-redistributable-4.9.0-287.el7
    • CNV 4.9 for RHEL 8 kubevirt-4.9.0-287.el8, kubevirt-virtctl-4.9.0-287.el8, kubevirt-virtctl-redistributable-4.9.0-287.el8
  • RHSA-2021:2122 Released 2021-06-01 · Red Hat rating Important
    OpenShift Container Platform 4.7.13 packages and security update
    • Red Hat OpenShift Container Platform 4.7 cri-o-1.20.2-12.rhaos4.7.git9f7be76.el7, cri-o-1.20.2-12.rhaos4.7.git9f7be76.el8, cri-tools-1.20.0-3.el7 +2
  • RHSA-2021:1515 Released 2021-05-06 · Red Hat rating Important
    Openshift Logging Bug Fix Release (5.0.3)
    • OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8, openshift-logging/eventrouter-rhel8
Show 17 more Red Hat advisories
  • RHSA-2021:1366 Released 2021-05-04 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.9 packages and security update
    • Red Hat OpenShift Container Platform 4.7 golang-github-prometheus-promu-0.5.0-3.git642a960.el8, prometheus-promu-0.5.0-3.git642a960.el8
  • RHSA-2021:1016 Released 2021-04-13 · Red Hat rating Low
    OpenShift Container Platform 4.5.37 security update
    • Red Hat OpenShift Container Platform 4.5 containers-common-1:1.1.1-2.rhaos4.5.el8, ignition-0.35.1-12.rhaos4.5.gitb4d18ad.el8, ignition-validate-0.35.1-12.rhaos4.5.gitb4d18ad.el8 +8
  • RHSA-2021:0956 Released 2021-03-30 · Red Hat rating Low
    OpenShift Container Platform 4.6.23 security update
    • Red Hat OpenShift Container Platform 4.6 openshift-eventrouter-0.2-6.git7c289cc.el8
  • RHSA-2021:0713 Released 2021-03-11 · Red Hat rating Low
    OpenShift Container Platform 4.5.34 packages and security update
    • Red Hat OpenShift Container Platform 4.5 apb-2.0.3-3.el7, apb-container-scripts-2.0.3-3.el7, apb-devel-2.0.3-3.el7 +14
  • RHSA-2021:0799 Released 2021-03-10 · Red Hat rating Moderate
    OpenShift Virtualization 2.6.0 security and bug fix update
    • CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
  • RHSA-2021:0172 Released 2021-01-25 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.13 packages and security update
    • Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-3.rhaos4.6.el8, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el7, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el8 +4
  • RHSA-2021:0072 Released 2021-01-11 · Red Hat rating Moderate
    OpenShift Serverless 1.9.0 release and security update
    • OpenShift Serverless 1.9.0
  • RHSA-2020:5649 Released 2020-12-22 · Red Hat rating Low
    Red Hat OpenShift Service Mesh 1.1.11 security update
    • OpenShift Service Mesh 1.1 ior-1.1.11-2.el8, servicemesh-1.1.11-2.el8, servicemesh-citadel-1.1.11-2.el8 +12
  • RHSA-2020:5605 Released 2020-12-17 · Red Hat rating Moderate
    Red Hat OpenShift Container Storage 4.6.0 security, bug fix, enhancement update
    • Red Hat OpenShift Container Storage 4.6 on RHEL-8 ocs4/cephcsi-rhel8, ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator +3
  • RHSA-2020:5606 Released 2020-12-17 · Red Hat rating Moderate
    Red Hat OpenShift Container Storage 4.6 bug fix and enhancement update
    • Red Hat OpenShift Container Storage 4.6 on RHEL-8 mcg-5.6.0-39.2279a46.5.6.el8
  • RHSA-2020:5159 Released 2020-11-30 · Red Hat rating Low
    OpenShift Container Platform 4.6.6 security update
    • Red Hat OpenShift Container Platform 4.6 faq-0.0.6-5.el8
  • RHSA-2020:5118 Released 2020-11-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.5.20 bug fix and golang security update
    • Red Hat OpenShift Container Platform 4.5 openshift4/ose-aws-machine-controllers, openshift4/ose-azure-machine-controllers, openshift4/ose-baremetal-machine-controllers +47
  • RHSA-2020:5119 Released 2020-11-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.5.20 packages and golang security update
    • Red Hat OpenShift Container Platform 4.5 cri-o-1.18.4-4.rhaos4.5.git6dee389.el7, cri-o-1.18.4-4.rhaos4.5.git6dee389.el8
  • RHSA-2020:4297 Released 2020-10-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.1 package security update
    • Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-2.rhaos4.6.el8, jenkins-2-plugins-4.6.1601368321-1.el8, openshift-clients-4.6.0-202010081244.p0.git.3794.4743d24.el7 +11
  • RHSA-2020:4214 Released 2020-10-08 · Red Hat rating Moderate
    go-toolset-1.13-golang security and bug fix update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.13-1.13.15-1.el7, go-toolset-1.13-build-1.13.15-1.el7, go-toolset-1.13-golang-1.13.15-3.el7 +7
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.13-1.13.15-1.el7, go-toolset-1.13-build-1.13.15-1.el7, go-toolset-1.13-golang-1.13.15-3.el7 +7
  • RHSA-2020:4201 Released 2020-10-06 · Red Hat rating Low
    OpenShift Virtualization 2.4.2 Images
    • CNV 2.4 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +1
  • RHSA-2020:3665 Released 2020-09-08 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.3.2-3.module+el8.2.0+5581+896cb53e.src::go-toolset:rhel8, delve-1.3.2-3.module+el8.2.0+5581+896cb53e.x86_64::go-toolset:rhel8, go-toolset-1.13.15-1.module+el8.2.0+7662+fa98b974.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Virtualization 1AffectedNo fix yet: Fix deferred
Red Hat OpenShift Virtualization 2AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet: Fix deferred
CNV 2.4 for RHEL 8Fixed RHSA-2020:4201
CNV 4.9 for RHEL 7Fixed RHSA-2021:4103
CNV 4.9 for RHEL 8Fixed RHSA-2021:4103
OpenShift Logging 5.0Fixed RHSA-2021:1515
OpenShift Serverless 1.9.0Fixed RHSA-2021:0072
OpenShift Service Mesh 1.0Fixed—
OpenShift Service Mesh 1.1Fixed RHSA-2020:5649
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:4214
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:4214
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:3665
Red Hat OpenShift Container Platform 4.4Fixed—
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2020:5118, RHSA-2020:5119, RHSA-2021:0713, RHSA-2021:1016
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2020:4297, RHSA-2020:5159, RHSA-2021:0172, RHSA-2021:0956
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2021:1366, RHSA-2021:2122
Red Hat OpenShift Container Storage 4.6 on RHEL-8Fixed RHSA-2020:5605, RHSA-2020:5606
Red Hat OpenShift Jaeger 1.17Fixed—
Red Hat OpenShift Jaeger 1.20Fixed—
Not affected: 8 products
  • OpenShift Logging 5.0
  • Red Hat OpenShift Container Platform 4.4
  • Red Hat OpenShift Container Platform 4.5
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.6 for System Z over RHEL 8
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat OpenShift Container Storage 4.6 on RHEL-8
  • Red Hat OpenShift Virtualization 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-16845

References

Advisory 13

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences