Unrated
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV)...
CVE-2020-25614
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2020-25614 golang-github-antchfx-xmlquery Fixed in: 1.3.3-1
Original description The description as published by the source.
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- patch github.com
- report github.com