github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)

高 7.5CVE-2021-29482 · GHSA-25xm-hr59-7c27 · GO-2020-0016 · 28/04/2021 公開 · 17/06/2026 更新

要点

CVE-2021-29482 は github.com/ulikunitz/xz, xz (xz project) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 73.1% より高い）。
対処：0.5.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/ulikunitz/xz Go	`< 0.5.8`	`0.5.8`
xz xz_project	`< 0.5.8`	`0.5.8`

概要

Impact

Patches

The problem has been fixed in release v0.5.8.

Workarounds

Limit the size of the compressed file input to a reasonable size for your use case.

References

The standard library had recently the same issue and got the CVE-2020-16845 allocated.

For more information

If you have any questions or comments about this advisory:

Open an issue in xz.

NVD の説明

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.