golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag
Published Jan 2, 2021
7.5
HIGHCVSS 3.1
EPSS 1.74%
Description
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
Affected products
No data.
No data.
OpenShift Service Mesh 2.0
servicemesh-0:2.0.9-3.el8
Fixed · RHSA-2022:1276
Red Hat Enterprise Linux 8
git-lfs-0:2.13.3-3.el8_6
Fixed · RHSA-2022:7129
Red Hat Enterprise Linux 9
podman-2:4.2.0-3.el9
Fixed · RHSA-2022:7954
Red Hat OpenShift Container Platform 4.10
openshift4-wincw/windows-machine-config-operator-bundle:v5.0.0-5
Fixed · RHSA-2022:0577
Red Hat OpenShift Container Platform 4.10
openshift4-wincw/windows-machine-config-rhel8-operator:5.0.0-5
Fixed · RHSA-2022:0577
Red Hat OpenShift Container Platform 4.8
openshift4/ose-thanos-rhel8:v4.8.0-202106291913.p0.git.c358e96.assembly.stream
Fixed · RHSA-2021:2438
OpenShift Service Mesh 2.0
servicemesh-cni
Affected
Red Hat Advanced Cluster Management for Kubernetes 2
go
Affected
Red Hat Ceph Storage 2
golang
Out of support scope
Red Hat Ceph Storage 3
golang
Out of support scope
Red Hat Enterprise Linux 7
buildah
Out of support scope
Red Hat Enterprise Linux 7
golang
Out of support scope
Red Hat Enterprise Linux 7
podman
Out of support scope
Red Hat Enterprise Linux 8
container-tools:1.0/buildah
Will not fix
Red Hat Enterprise Linux 8
container-tools:1.0/podman
Out of support scope
Red Hat Enterprise Linux 8
container-tools:2.0/buildah
Will not fix
Red Hat Enterprise Linux 8
container-tools:2.0/podman
Affected
Red Hat Enterprise Linux 8
container-tools:rhel8/buildah
Will not fix
Red Hat Enterprise Linux 8
container-tools:rhel8/podman
Affected
Red Hat Enterprise Linux 8
go-toolset:rhel8/golang
Not affected
Red Hat Enterprise Linux 9
buildah
Not affected
Red Hat Enterprise Linux 9
git-lfs
Not affected
Red Hat Enterprise Linux 9
golang
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-enterprise-service-catalog
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift-descheduler
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift-dockerregistry
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift-metrics-server
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift-node-problem-detector
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift-service-idler
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift-web-console
Not affected
Red Hat OpenShift Container Platform 3.11
csi-attacher
Not affected
Red Hat OpenShift Container Platform 3.11
csi-driver-registrar
Not affected
Red Hat OpenShift Container Platform 3.11
csi-livenessprobe
Not affected
Red Hat OpenShift Container Platform 3.11
csi-provisioner
Not affected
Red Hat OpenShift Container Platform 3.11
golang-github-openshift-oauth-proxy
Not affected
Red Hat OpenShift Container Platform 3.11
golang-github-prometheus-prometheus
Not affected
Red Hat OpenShift Container Platform 3.11
heapster
Not affected
Red Hat OpenShift Container Platform 3.11
openshift-enterprise-cluster-capacity
Not affected
Red Hat OpenShift Container Platform 3.11
openshift-enterprise-image-registry
Not affected
Red Hat OpenShift Container Platform 3.11
openshift-external-storage
Not affected
Red Hat OpenShift Container Platform 3.11
podman
Not affected
Red Hat OpenShift Container Platform 4
cri-o
Not affected
Red Hat OpenShift Container Platform 4
cri-tools
Not affected
Red Hat OpenShift Container Platform 4
openshift
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-ansible-rhel9-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-aws-ebs-csi-driver-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-baremetal-installer-rhel9
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-logging-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-node-tuning-rhel9-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-csi-driver-manila-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-csi-driver-nfs-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-elasticsearch-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-elasticsearch-proxy
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-helm-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-hyperkube
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-installer
Will not fix
Red Hat OpenShift Container Platform 4
openshift4/ose-local-storage-diskmaker-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-local-storage-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-multus-cni
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-network-metrics-daemon-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-node-feature-discovery
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-ptp-rhel9-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-sriov-network-config-daemon
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-sriov-network-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-sriov-network-webhook
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-sriov-operator-must-gather
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-tests
Not affected
Red Hat OpenShift Container Platform 4
podman
Not affected
Red Hat OpenShift Virtualization 2
bridge-marker
Not affected
Red Hat OpenShift Virtualization 2
cluster-network-addons-operator
Not affected
Red Hat OpenShift Virtualization 2
cnv-containernetworking-plugins
Not affected
Red Hat OpenShift Virtualization 2
hostpath-provisioner
Not affected
Red Hat OpenShift Virtualization 2
hostpath-provisioner-operator
Not affected
Red Hat OpenShift Virtualization 2
kubemacpool
Not affected
Red Hat OpenShift Virtualization 2
kubernetes-nmstate-handler
Not affected
Red Hat OpenShift Virtualization 2
kubevirt-metrics-collector
Will not fix
Red Hat OpenShift Virtualization 2
kubevirt-template-validator
Not affected
Red Hat OpenShift Virtualization 2
kubevirt-vmware
Not affected
Red Hat OpenShift Virtualization 2
node-maintenance-operator
Not affected
Red Hat OpenShift Virtualization 2
ovs-cni-marker
Not affected
Red Hat OpenShift Virtualization 2
ovs-cni-plugin
Not affected
Red Hat OpenShift Virtualization 2
virt-api
Not affected
Red Hat OpenShift Virtualization 2
virt-cdi-apiserver
Not affected
Red Hat OpenShift Virtualization 2
vm-import-controller
Not affected
Red Hat Openshift Container Storage 4
ocs4/cephcsi-rhel8
Fix deferred
Red Hat Openshift Container Storage 4
ocs4/ocs-must-gather-rhel8
Not affected
Red Hat Openshift Container Storage 4
ocs4/ocs-rhel8-operator
Fix deferred
Red Hat Quay 3
quay/clair-rhel8
Affected
Red Hat Software Collections
rh-git218-git-lfs
Not affected
Red Hat Software Collections
rh-git227-git-lfs
Will not fix
Red Hat Storage 3
golang
Not affected
Red Hat Storage 3
grafana
Fix deferred
Red Hat Storage 3
heketi
Fix deferred
Red Hat Storage 3
rhgs3/rhgs-gluster-block-prov-rhel7
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| OpenShift Service Mesh 2.0 | servicemesh-0:2.0.9-3.el8 | Fixed | RHSA-2022:1276 |
| Red Hat Enterprise Linux 8 | git-lfs-0:2.13.3-3.el8_6 | Fixed | RHSA-2022:7129 |
| Red Hat Enterprise Linux 9 | podman-2:4.2.0-3.el9 | Fixed | RHSA-2022:7954 |
| Red Hat OpenShift Container Platform 4.10 | openshift4-wincw/windows-machine-config-operator-bundle:v5.0.0-5 | Fixed | RHSA-2022:0577 |
| Red Hat OpenShift Container Platform 4.10 | openshift4-wincw/windows-machine-config-rhel8-operator:5.0.0-5 | Fixed | RHSA-2022:0577 |
| Red Hat OpenShift Container Platform 4.8 | openshift4/ose-thanos-rhel8:v4.8.0-202106291913.p0.git.c358e96.assembly.stream | Fixed | RHSA-2021:2438 |
| OpenShift Service Mesh 2.0 | servicemesh-cni | Affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | go | Affected | n/a |
| Red Hat Ceph Storage 2 | golang | Out of support scope | n/a |
| Red Hat Ceph Storage 3 | golang | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | buildah | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | golang | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | podman | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | container-tools:1.0/buildah | Will not fix | n/a |
| Red Hat Enterprise Linux 8 | container-tools:1.0/podman | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | container-tools:2.0/buildah | Will not fix | n/a |
| Red Hat Enterprise Linux 8 | container-tools:2.0/podman | Affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/buildah | Will not fix | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/podman | Affected | n/a |
| Red Hat Enterprise Linux 8 | go-toolset:rhel8/golang | Not affected | n/a |
| Red Hat Enterprise Linux 9 | buildah | Not affected | n/a |
| Red Hat Enterprise Linux 9 | git-lfs | Not affected | n/a |
| Red Hat Enterprise Linux 9 | golang | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-enterprise-service-catalog | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-descheduler | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-dockerregistry | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-metrics-server | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-node-problem-detector | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-service-idler | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-web-console | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | csi-attacher | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | csi-driver-registrar | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | csi-livenessprobe | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | csi-provisioner | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | golang-github-openshift-oauth-proxy | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | golang-github-prometheus-prometheus | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | heapster | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift-enterprise-cluster-capacity | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift-enterprise-image-registry | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift-external-storage | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | podman | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | cri-o | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | cri-tools | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-ansible-rhel9-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-aws-ebs-csi-driver-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-installer-rhel9 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-logging-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-node-tuning-rhel9-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-csi-driver-manila-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-csi-driver-nfs-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-elasticsearch-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-elasticsearch-proxy | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-helm-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-hyperkube | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-local-storage-diskmaker-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-local-storage-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-multus-cni | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-network-metrics-daemon-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-node-feature-discovery | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-ptp-rhel9-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sriov-network-config-daemon | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sriov-network-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sriov-network-webhook | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sriov-operator-must-gather | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-tests | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | podman | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | bridge-marker | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | cluster-network-addons-operator | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | cnv-containernetworking-plugins | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | hostpath-provisioner | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | hostpath-provisioner-operator | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | kubemacpool | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | kubernetes-nmstate-handler | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | kubevirt-metrics-collector | Will not fix | n/a |
| Red Hat OpenShift Virtualization 2 | kubevirt-template-validator | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | kubevirt-vmware | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | node-maintenance-operator | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | ovs-cni-marker | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | ovs-cni-plugin | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-api | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-apiserver | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | vm-import-controller | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/cephcsi-rhel8 | Fix deferred | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-must-gather-rhel8 | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-rhel8-operator | Fix deferred | n/a |
| Red Hat Quay 3 | quay/clair-rhel8 | Affected | n/a |
| Red Hat Software Collections | rh-git218-git-lfs | Not affected | n/a |
| Red Hat Software Collections | rh-git227-git-lfs | Will not fix | n/a |
| Red Hat Storage 3 | golang | Not affected | n/a |
| Red Hat Storage 3 | grafana | Fix deferred | n/a |
| Red Hat Storage 3 | heketi | Fix deferred | n/a |
| Red Hat Storage 3 | rhgs3/rhgs-gluster-block-prov-rhel7 | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Below Red Hat products include the affected version of 'golang.org/x/text', however the language package is not being used and hence they are rated as having a security impact of Low. A future update may address this issue. * Red Hat OpenShift Container Storage 4 * OpenShift ServiceMesh (OSSM) * Red Hat Gluster Storage 3 * Windows Container Support for Red Hat OpenShift Only three components in OpenShift Container Platform include the affected package, 'golang.org/x/text/language' , the installer, baremetal installer and thanos container images. All other components that include a version of 'golang.org/x/text' do not include the 'language' package and are therefore not affected.
References (7)
- https://access.redhat.com/security/cve/CVE-2020-28852 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1913338 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21244 Advisory
- https://github.com/golang/go/issues/42536 x_refsource_MISCExploitIssue TrackingThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-28852
- https://security.netapp.com/advisory/ntap-20210212-0004/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-28852
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-28852 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1913338 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21244 | Advisory | |
| https://github.com/golang/go/issues/42536 | x_refsource_MISCExploitIssue TrackingThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-28852 | ||
| https://security.netapp.com/advisory/ntap-20210212-0004/ | x_refsource_CONFIRMThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2020-28852 |
Change history (0)
No recorded changes yet.