CVE-2020-29510 log

Source
Severity Medium
Remote No
Type Incorrect calculation
Description
Go's encoding/xml handles XML directives in a way that causes crafted markup to mutate during round-trips through the xml.Decoder and xml.Encoder implementations. Encoding and decoding using Go's encoding/xml can introduce new structures around a maliciously crafted XML directive.

Affected applications include software that relies on XML integrity for security-sensitive decisions. Prominent examples of such applications include SAML and XML-DSig implementations.
Group Package Affected Fixed Severity Status Ticket
AVG-1357 go 2:1.15.6-1 Medium Vulnerable
AVG-1358 mattermost 5.26.1-1 5.26.2-1 Medium Fixed
References
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
https://github.com/mattermost/xml-roundtrip-validator
Notes
Workaround
==========

The github.com/mattermost/xml-roundtrip-validator module can detect unstable constructs in an XML document, including unstable directives. Invoking the validator on all untrusted markup and failing early if it returns an error can prevent these types of issue from being exploited in an otherwise affected application.