CVE-2020-29511 affects the encoding/xml package in all versions of Go, as well as products like NetApp Go and Trident. This vulnerability allows attackers to craft XML inputs that behave inconsistently during different processing stages due to improper preservation of element namespace prefixes. With a CVSS score of 5.6 (Medium), it has a network attack vector and high attack complexity, potentially leading to low impact on confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion and media coverage, including a BleepingComputer article detailing its potential for SAML authentication bypass.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.17CPE matchmatch criteria | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
go: encoding/xml: XML element instability
Dec 14, 2020The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Dec 8, 2020