Skip to content
Fencer Intel
high 7.5

CVE-2020-16845 json

Unbounded read from invalid inputs in encoding/binary

published 6y ago modified 2mo ago also BIT-golang-2020-16845 , EUVD-2021-2567 , GHSA-q6gq-997w-f55g , GO-2021-0142

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.9%
EPSS 4.9% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Patch / fix

  • bitnami golang 1.13.15, 1.14.7
  • go stdlib 1.13.15, 1.14.7
  • golang go 1.13.15, 1.14.7
  • golang-1.15 Debian 11 1.15~rc2-1

debian advisories DEBIAN-CVE-2020-16845

  • golang-1.13 Ubuntu 18.04 LTS 1.13.8-1ubuntu1~18.04.4
  • golang-1.13 Ubuntu 20.04 LTS 1.13.8-1ubuntu1.1
  • golang-1.13 Ubuntu 22.04 LTS 1.13.8-1ubuntu2.22.04.1
  • golang-1.13 Ubuntu Pro 16.04 LTS 1.13.8-1ubuntu1~16.04.3+esm2

ubuntu advisories UBUNTU-CVE-2020-16845

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • delve RHEL 8 1.3.2-3.module+el8.2.0+5581+896cb53e
  • golang RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • go-toolset RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-bin RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-src RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-misc RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-race RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-tests RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974

red hat advisories RHSA-2020:3665RHSA-2020:5606RHSA-2020:4297RHSA-2020:4214RHBA-2020:4197RHSA-2021:4103

  • go1.14 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.14.7-1.15.1

suse advisories SUSE-SU-2020:2562-1

  • go1.13 openSUSE Tumbleweed 1.13.15-2.6
  • go1.14 openSUSE Tumbleweed 1.14.15-1.6
  • go1.14 openSUSE Leap 15.2 1.14.7-lp152.2.3.1
  • go1.14 openSUSE Leap 15.1 1.14.7-lp151.13.1
  • go1.13 openSUSE Leap 15.2 1.13.15-lp152.2.7.1
  • go1.13 openSUSE Leap 15.1 1.13.15-lp151.8.1

opensuse advisories openSUSE-SU-2024:10806-1openSUSE-SU-2024:10807-1openSUSE-SU-2020:1407-1openSUSE-SU-2020:1405-1openSUSE-SU-2020:1194-1openSUSE-SU-2020:1178-1

  • go Alpine 3.12 1.13.15-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.15-r0

alpine advisories ALPINE-CVE-2020-16845

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2020-16845 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-16845 updated cvss 7.5

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

  • Red Hat OpenShift Service Mesh 1 kiali, jaeger, jaeger-operator
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, prometheus-node-exporter Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, golang, libgcc, +20 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 apb, cri-o, podman, cockpit, heapster, cri-tools, +59 more Red Hat OpenShift Container Platform 4 pivot, openshift-golang-builder-container Red Hat OpenShift Virtualization 1 golang, kubevirt-cdi, kubevirt-virtctl
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Virtualization 2 virt-api, kubemacpool, virt-handler, bridge-marker, virt-launcher, virt-operator, +25 more
    affected: no fix available
  • Red Hat Storage 3 etcd, golang, heketi, grafana, golang-bin, golang-src, +7 more
    affected: no fix available “Fix deferred”
  • Red Hat CNV 2.4 for RHEL 8 container-native-virtualization/kubevirt-cpu-node-labeller v2.4.2-1, container-native-virtualization/vm-import-controller-rhel8 v2.4.2-1, container-native-virtualization/kubevirt-kvm-info-nfd-plugin v2.4.2-1, container-native-virtualization/kubevirt-cpu-model-nfd-plugin v2.4.2-1
    fixed: vendor fix RHSA-2020:4201
show 17 more
  • Red Hat CNV 4.9 for RHEL 7 kubevirt 4.9.0-287.el7, kubevirt-virtctl 4.9.0-287.el7, kubevirt-virtctl-redistributable 4.9.0-287.el7 Red Hat CNV 4.9 for RHEL 8 kubevirt 4.9.0-287.el8, kubevirt-virtctl 4.9.0-287.el8, kubevirt-virtctl-redistributable 4.9.0-287.el8
    fixed: vendor fix RHSA-2021:4103
  • Red Hat OpenShift Logging 5.0 openshift-logging/eventrouter-rhel8 v5.0.3-1
    fixed: vendor fix RHSA-2021:1515
  • Red Hat OpenShift Serverless 1.9.0
    fixed: vendor fix RHSA-2021:0072
  • Red Hat OpenShift Service Mesh 1.0 openshift-service-mesh/3scale-istio-adapter-rhel8 1.0.0-9
    fixed: vendor fix RHBA-2020:4139
  • Red Hat OpenShift Service Mesh 1.1 ior 1.1.11-2.el8, servicemesh 1.1.11-2.el8, servicemesh-cni 1.1.11-2.el8, servicemesh-mixc 1.1.11-2.el8, servicemesh-mixs 1.1.11-2.el8, servicemesh-galley 1.1.11-2.el8, +9 more
    fixed: vendor fix RHSA-2020:5649
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.13 1.13.15-1.el7, go-toolset-1.13-build 1.13.15-1.el7, go-toolset-1.13-golang 1.13.15-3.el7, go-toolset-1.13-runtime 1.13.15-1.el7, go-toolset-1.13-golang-bin 1.13.15-3.el7, go-toolset-1.13-golang-src 1.13.15-3.el7, +3 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.13 1.13.15-1.el7, go-toolset-1.13-build 1.13.15-1.el7, go-toolset-1.13-golang 1.13.15-3.el7, go-toolset-1.13-runtime 1.13.15-1.el7, go-toolset-1.13-golang-bin 1.13.15-3.el7, go-toolset-1.13-golang-src 1.13.15-3.el7, +3 more
    fixed: vendor fix RHSA-2020:4214
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.3.2-3.module+el8.2.0+5581+896cb53e, golang 1.13.15-1.module+el8.2.0+7662+fa98b974, go-toolset 1.13.15-1.module+el8.2.0+7662+fa98b974, golang-bin 1.13.15-1.module+el8.2.0+7662+fa98b974, golang-src 1.13.15-1.module+el8.2.0+7662+fa98b974, golang-misc 1.13.15-1.module+el8.2.0+7662+fa98b974, +2 more
    fixed: vendor fix RHSA-2020:3665
  • Red Hat OpenShift Container Platform 4.4 faq 0.0.6-5.el7, openshift 4.4.0-202011130111.p0.git.0.4861dfa.el7, openshift 4.4.0-202011130111.p0.git.0.4861dfa.el8, openshift-hyperkube 4.4.0-202011130111.p0.git.0.4861dfa.el7, openshift-hyperkube 4.4.0-202011130111.p0.git.0.4861dfa.el8, openshift-clients 4.4.0-202011122017.p0.git.3445.6937a03.el7, +3 more
    fixed: vendor fix RHBA-2020:5123
  • Red Hat OpenShift Container Platform 4.5 apb 2.0.3-3.el7, cri-tools 1.18.0-4.el7, cri-tools 1.18.0-4.el8, podman 1.9.3-2.rhaos4.5.el8, skopeo 1.1.1-2.rhaos4.5.el8, buildah 1.11.6-9.rhaos4.5.el8, +104 more
    fixed: vendor fix RHSA-2021:0713
  • Red Hat OpenShift Container Platform 4.6 faq 0.0.6-5.el8, podman 1.9.3-3.rhaos4.6.el8, skopeo 1.1.1-3.rhaos4.6.el8, podman-tests 1.9.3-3.rhaos4.6.el8, skopeo-tests 1.1.1-3.rhaos4.6.el8, podman-docker 1.9.3-3.rhaos4.6.el8, +15 more
    fixed: vendor fix RHBA-2020:4197
  • Red Hat OpenShift Container Platform 4.7 cri-tools 1.20.0-3.el7, redhat-release-coreos 47.83-2.el8, jenkins-2-plugins 4.7.1621361158-1.el8, cri-o 1.20.2-12.rhaos4.7.git9f7be76.el7, cri-o 1.20.2-12.rhaos4.7.git9f7be76.el8, prometheus-promu 0.5.0-3.git642a960.el8, +1 more
    fixed: vendor fix RHSA-2021:2122
  • Red Hat OpenShift Container Storage 4.6 on RHEL-8 mcg 5.6.0-39.2279a46.5.6.el8, ocs4/mcg-rhel8-operator 5.6.0-39.2279a46.5.6, ocs4/cephcsi-rhel8 4.6-52.49cf5efdd.release_4.6, ocs4/ocs-rhel8-operator 4.6-76.0811c33c.release_4.6, ocs4/ocs-must-gather-rhel8 4.6-76.0811c33c.release_4.6, ocs4/rook-ceph-rhel8-operator 4.6-80.1ae5ac6a.release_4.6
    fixed: vendor fix RHSA-2020:5606
  • Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel8 1.17.8-12, distributed-tracing/jaeger-query-rhel8 1.17.8-10, distributed-tracing/jaeger-ingester-rhel8 1.17.8-12, distributed-tracing/jaeger-rhel8-operator 1.17.8-11, distributed-tracing/jaeger-collector-rhel8 1.17.8-10, distributed-tracing/jaeger-all-in-one-rhel8 1.17.8-12, +2 more
    fixed: vendor fix RHBA-2021:0075
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.2-2, distributed-tracing/jaeger-query-rhel8 1.20.2-2, distributed-tracing/jaeger-ingester-rhel8 1.20.2-2, distributed-tracing/jaeger-rhel8-operator 1.20.2-2, distributed-tracing/jaeger-collector-rhel8 1.20.2-3, distributed-tracing/jaeger-all-in-one-rhel8 1.20.2-2, +2 more
    fixed: vendor fix RHBA-2021:0101
  • Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.3-1, openshift-logging/kibana6-rhel8 v5.0.3-1, openshift-logging/elasticsearch6-rhel8 v5.0.3-1, openshift-logging/logging-curator5-rhel8 v5.0.3-1, openshift-logging/elasticsearch-proxy-rhel8 v5.0.3-1, openshift-logging/elasticsearch-rhel8-operator v5.0.3-2, +3 more Red Hat OpenShift Container Platform 4.4 iptables 1.8.4-10.el8_2.4, iptables-libs 1.8.4-10.el8_2.4, iptables-utils 1.8.4-10.el8_2.4, iptables-ebtables 1.8.4-10.el8_2.4, iptables-services 1.8.4-10.el8_2.4, iptables-arptables 1.8.4-10.el8_2.4, +5 more Red Hat OpenShift Container Platform 4.5 faq 0.0.6-5.el7, perf 4.18.0-193.24.1.el8_2.dt1, kernel 4.18.0-193.24.1.el8_2.dt1, bpftool 4.18.0-193.24.1.el8_2.dt1, kernel-core 4.18.0-193.24.1.el8_2.dt1, kernel-tools 4.18.0-193.24.1.el8_2.dt1, +68 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4.6 jq 1.6-2.el7, jq 1.6-2.el8, faq 0.0.6-4.el8, ostree 2020.5-4.el8, pprof 2.6.3-2.el8+7, tini 0.16.1-1.el8ar, +299 more
    not affected: vulnerable code not present RHSA-2020:4297
  • Red Hat OpenShift Container Platform 4.6 for System Z over RHEL 8 s390utils 2.6.0-28.el8_2.2, s390utils-base 2.6.0-28.el8_2.2, s390utils-cmsfs 2.6.0-28.el8_2.2, s390utils-zdsfs 2.6.0-28.el8_2.2, s390utils-ziomon 2.6.0-28.el8_2.2, s390utils-cpuplugd 2.6.0-28.el8_2.2, +6 more Red Hat OpenShift Container Platform 4.7 openshift 4.7.0-202104250659.p0.git.7d0a2b2.el7, openshift 4.7.0-202104250659.p0.git.7d0a2b2.el8, openshift-kuryr 4.7.0-202104250659.p0.git.d49acc4.el8, openshift-ansible 4.7.0-202104250659.p0.git.e1b19c2.el7, openshift-clients 4.7.0-202104250659.p0.git.95881af.el7, openshift-clients 4.7.0-202104250659.p0.git.95881af.el8, +10 more Red Hat OpenShift Container Storage 4.6 on RHEL-8 tini 0.18.0-5.el8, ocs4/ocs-operator-bundle 4.6.0-7, ocs4/mcg-core-rhel8 5.6.0-38.31e0c3c7b.5.6 Red Hat OpenShift Virtualization 2 cnv-must-gather
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.86% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.13.15
>=1.14.0, <1.14.7
1.13.15
1.14.7
go stdlib
<1.13.15
>=1.14.0-0, <1.14.7
1.13.15
1.14.7

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.