xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz contain...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 golang-github-ulikunitz-xz

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2"}]}]

Debian:13 golang-github-ulikunitz-xz

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2"}]}]

Debian:14 golang-github-ulikunitz-xz

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2"}]}]

参照URL

advisory security-tracker.debian.org