Skip to content
Fencer Intel
high 7.5

CVE-2020-14040 json

golang.org/x/text Infinite loop

published 6y ago modified last mo. also GHSA-5rcv-m4m3-hfh7 , GO-2020-0015 , EUVD-2021-0962

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Patch / fix

  • go golang.org/x/text 0.3.3
  • golang text 0.3.3
  • golang-golang-x-text Debian 14, Debian 13, Debian 12 0.3.3-1

debian advisories DEBIAN-CVE-2020-14040

  • golang-x-text Ubuntu 18.04 LTS 0.0~git20170627.0.6353ef0-1ubuntu2.1
  • golang-golang-x-text Ubuntu 20.04 LTS 0.3.2-4ubuntu0.1

ubuntu advisories UBUNTU-CVE-2020-14040

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.14-2.module+el8.3.0+8221+97165c3f
  • criu RHEL 8 3.14-2.module+el8.3.0+8221+97165c3f
  • crun RHEL 8 0.14.1-2.module+el8.3.0+8221+97165c3f
  • runc RHEL 8 1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
  • udica RHEL 8 0.2.2-1.module+el8.3.0+8221+97165c3f
  • conmon RHEL 8 2:2.0.20-2.module+el8.3.0+8221+97165c3f
  • podman RHEL 8 2.0.5-5.module+el8.3.0+8221+97165c3f
  • skopeo RHEL 8 1:1.1.1-3.module+el8.3.0+8221+97165c3f

red hat advisories RHSA-2020:4694RHSA-2020:3665RHSA-2020:5606RHSA-2020:5056RHSA-2020:5055RHSA-2020:5054

  • libslirp AlmaLinux 8 4.3.1-1.module_el8.6.0+2876+9ed4eae2
  • python-podman-api AlmaLinux 8 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
  • python-podman-api AlmaLinux 8 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455

almalinux advisories ALSA-2020:4694

  • toolbox Rocky Linux 8 0.0.8-1.module+el8.4.0+556+40122d08
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.7.0+1076+9b1c11c1
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.4.0+556+40122d08
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.5.0+709+440d5e7e
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.6.0+783+10209741
  • python-podman-api Rocky Linux 8 1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861
  • python-podman-api Rocky Linux 8 1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2
  • python-podman-api Rocky Linux 8 1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d

rocky linux advisories RLSA-2020:4694

  • podman Azure Linux 3.0 5.6.1-2
  • buildah Azure Linux 3.0 1.41.4-2

azure linux advisories AZL-44364AZL-44877

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2020-14040 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14040 updated cvss 7.5

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

  • Red Hat OpenShift Developer Tools and Services jenkins-operator-container Red Hat OpenShift Service Mesh 1 jaeger, jaeger-operator
    affected: no fix planned “Out of support scope”
  • Red Hat Advanced Cluster Management for Kubernetes 2 search-operator, search-collector, configmap-watcher, metrics-collector, search-aggregator, management-ingress, +15 more
    affected: no fix available
  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests Red Hat Enterprise Linux 8 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +7 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 openshift3/grafana, openshift3/prometheus, openshift3/oauth-proxy, openshift3/ose-descheduler, openshift3/ose-kube-rbac-proxy, openshift3/ose-service-catalog, +9 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 buildah, buildah-tests, thanos-container, ose-sdn-container, promtail-container, openshift4/ose-grafana, +44 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 1 virt-api, multus-cni, virt-handler, virt-launcher, virt-operator, ovs-cni-plugin, +13 more
    affected: no fix planned “Out of support scope”
show 23 more
  • Red Hat OpenShift Virtualization 2 virt-api, kubemacpool, virt-handler, bridge-marker, virt-launcher, virt-operator, +19 more
    affected: no fix available
  • Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more Red Hat Service Telemetry Framework 1.2 for RHEL 8 stf/sg-core-rhel8 Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Serverless 1.11 openshift-serverless-1/client-kn-rhel8 0.17.3-2, openshift-serverless-1/serving-queue-rhel8 0.17.3-4, openshift-serverless-1/eventing-mtping-rhel8 0.17.2-9, openshift-serverless-1/kourier-control-rhel8 0.17.0-3, openshift-serverless-1/serving-webhook-rhel8 0.17.3-4, openshift-serverless-1/ingress-rhel8-operator 1.11.0-6, +20 more
    fixed: vendor fix RHSA-2020:5149
  • Red Hat OpenShift Service Mesh 1.0 openshift-service-mesh/3scale-istio-adapter-rhel8 1.0.0-8
    fixed: vendor fix RHSA-2020:3372
  • Red Hat OpenShift Service Mesh 1.1 ior 1.1.6-1.el8, servicemesh 1.1.6-1.el8, servicemesh-cni 1.1.6-1.el8, servicemesh-mixc 1.1.6-1.el8, servicemesh-mixs 1.1.6-1.el8, servicemesh-galley 1.1.6-1.el8, +9 more
    fixed: vendor fix RHSA-2020:3369
  • Red Hat Quay v3 quay/quay-rhel8 v3.4.0-51, quay/clair-rhel8 v3.4.0-25, quay/quay-builder-rhel8 v3.4.0-18, quay/quay-operator-bundle v3.4.0-89, quay/quay-operator-rhel8 v3.4.0-132, quay/quay-bridge-operator-bundle v3.4.0-3, +5 more
    fixed: vendor fix RHSA-2021:0420
  • Red Hat 3Scale AMP 2.10 3scale-amp2/3scale-rhel7-operator 1.13.0-17, 3scale-amp2/apicast-rhel7-operator 1.13.0-4, 3scale-amp2/3scale-rhel7-operator-metadata 3scale2.10.0, 3scale-amp2/apicast-rhel7-operator-metadata 3scale2.10.0
    fixed: vendor fix RHSA-2021:1129
  • Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8 rhacm2/acm-must-gather-rhel8 v2.1.3-5, rhacm2/acm-must-gather-rhel8 v2.1.6-6
    fixed: vendor fix RHSA-2021:0980
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.13 1.13.15-1.el7, go-toolset-1.13-build 1.13.15-1.el7, go-toolset-1.13-golang 1.13.15-3.el7, go-toolset-1.13-runtime 1.13.15-1.el7, go-toolset-1.13-golang-bin 1.13.15-3.el7, go-toolset-1.13-golang-src 1.13.15-3.el7, +3 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.13 1.13.15-1.el7, go-toolset-1.13-build 1.13.15-1.el7, go-toolset-1.13-golang 1.13.15-3.el7, go-toolset-1.13-runtime 1.13.15-1.el7, go-toolset-1.13-golang-bin 1.13.15-3.el7, go-toolset-1.13-golang-src 1.13.15-3.el7, +3 more
    fixed: vendor fix RHSA-2020:4214
  • Red Hat Enterprise Linux 7 Extras podman 1.6.4-26.el7_9, skopeo 0.1.40-12.el7_9, buildah 1.11.6-12.el7_9, podman-docker 1.6.4-26.el7_9, containers-common 0.1.40-12.el7_9
    fixed: vendor fix RHSA-2020:5055
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.14-2.module+el8.3.0+8221+97165c3f, criu 3.14-2.module+el8.3.0+8221+97165c3f, crun 0.14.1-2.module+el8.3.0+8221+97165c3f, delve 1.3.2-3.module+el8.2.0+5581+896cb53e, udica 0.2.2-1.module+el8.3.0+8221+97165c3f, podman 2.0.5-5.module+el8.3.0+8221+97165c3f, +28 more
    fixed: vendor fix RHSA-2020:3665
  • Red Hat Fuse 7.9
    fixed: vendor fix RHSA-2021:3140
  • Red Hat Integration
    fixed: vendor fix RHSA-2021:2039
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-docker-registry v3.11.286-1
    fixed: vendor fix RHSA-2020:3727
  • Red Hat OpenShift Container Platform 4.4 openshift4/ose-cluster-network-operator v4.4.0-202009120105.p0
    fixed: vendor fix RHSA-2020:3783
  • Red Hat OpenShift Container Platform 4.5 openshift4/ose-cluster-network-operator v4.5.0-202008210149.p0, openshift4/ose-cluster-version-operator v4.5.0-202008280601.p0, openshift4/ose-cluster-svcat-apiserver-operator v4.5.0-202009112201.p0
    fixed: vendor fix RHSA-2020:3578
  • Red Hat OpenShift Container Platform 4.6 podman 1.9.3-3.rhaos4.6.el8, skopeo 1.1.1-2.rhaos4.6.el8, podman-tests 1.9.3-3.rhaos4.6.el8, skopeo-tests 1.1.1-2.rhaos4.6.el8, podman-docker 1.9.3-3.rhaos4.6.el8, podman-remote 1.9.3-3.rhaos4.6.el8, +75 more
    fixed: vendor fix RHSA-2020:4297
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-ovn-kubernetes v4.7.0-202102130115.p0, openshift4/ose-cluster-bootstrap v4.7.0-202102130115.p0, openshift4/ose-metering-helm-container-rhel8 v4.7.0-202102110027.p0
    fixed: vendor fix RHSA-2020:5633
  • Red Hat OpenShift Container Storage 4.6 on RHEL-8 mcg 5.6.0-39.2279a46.5.6.el8, ocs4/mcg-rhel8-operator 5.6.0-39.2279a46.5.6, ocs4/cephcsi-rhel8 4.6-52.49cf5efdd.release_4.6, ocs4/ocs-rhel8-operator 4.6-76.0811c33c.release_4.6, ocs4/ocs-must-gather-rhel8 4.6-76.0811c33c.release_4.6, ocs4/rook-ceph-rhel8-operator 4.6-80.1ae5ac6a.release_4.6
    fixed: vendor fix RHSA-2020:5606
  • Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel7 1.17.5-3, distributed-tracing/jaeger-query-rhel7 1.17.5-3, distributed-tracing/jaeger-ingester-rhel7 1.17.5-3, distributed-tracing/jaeger-rhel7-operator 1.17.5-3, distributed-tracing/jaeger-collector-rhel7 1.17.5-3, distributed-tracing/jaeger-all-in-one-rhel7 1.17.5-3
    fixed: vendor fix RHSA-2020:3087
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.1-3, distributed-tracing/jaeger-query-rhel8 1.20.1-3, distributed-tracing/jaeger-ingester-rhel8 1.20.1-3, distributed-tracing/jaeger-collector-rhel8 1.20.1-3, distributed-tracing/jaeger-all-in-one-rhel8 1.20.1-3
    fixed: vendor fix RHSA-2020:5198
  • Red Hat OpenShift Service Mesh 1.1 kiali v1.12.10.redhat2-1.el7
    fixed: vendor fix RHSA-2020:3369
  • Red Hat Advanced Cluster Management for Kubernetes 2 hive, work, grafana, registration, rcm-controller, rbac-query-proxy, +8 more Red Hat Enterprise Linux 8 podman, skopeo, podman-tests, skopeo-tests, podman-docker, podman-remote, +5 more Red Hat Enterprise Linux 9 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat OpenShift Container Platform 3.11 openshift-jenkins-2-container, openshift3/jenkins-slave-base-rhel7, jenkins-agent-maven-35-rhel7-container, jenkins-agent-nodejs-8-rhel7-container, openshift3/ose-cluster-monitoring-operator, openshift3/ose-logging-kibana5 v3.11.286-1
    not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.89% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Affected packages

ecosystem package affected fixed in
go golang.org/x/text
<0.3.3
0.3.3

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.