This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-29482 →
DEBIAN-CVE-2021-29482
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz contain...
Original description
The description as published by the source.
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
golang-github-ulikunitz-xz
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2"}]}]
Debian:13
golang-github-ulikunitz-xz
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2"}]}]
Debian:14
golang-github-ulikunitz-xz
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2"}]}]
References
- advisory security-tracker.debian.org