| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ulikunitz/xz | < 0.5.8 | 0.5.8 |
| xz | < 0.5.8 | 0.5.8 |
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.
The problem has been fixed in release v0.5.8.
Limit the size of the compressed file input to a reasonable size for your use case.
The standard library had recently the same issue and got the CVE-2020-16845 allocated.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free