01 Record

CVE-2020-28362

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 3.85% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 89.7% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2020-11-18 16:27Z5 YR AGO

Last updated

2024-08-04 16:33Z2 YR AGO

Reserved

2020-11-09

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-295Improper Certificate ValidationBase

Data version

5.1

Document digest

53451d518bbf62eed4fe73df291538114fe55f1e2b51a963fc7815a30e02b90b

05 Affected products

VendorProductVersionsPlatforms

fedoraprojectfedoraNot specified—

golanggoNot specified—

netappcloud_insights_telegraf_agentNot specified—

netapptridentNot specified—

redhatassisted_installerNot specified—

redhatceph_storageNot specified—

redhatcontainer_native_virtualizationNot specified—

redhatdevtoolsNot specified—

redhatenterprise_linuxNot specified—

redhatjaegerNot specified—

redhatopenshiftNot specified—

redhatopenshift_container_storageNot specified—

redhatserverlessNot specified—

redhatservice_meshNot specified—

redhatstorageNot specified—

06 References

lists.apache.org[trafficcontrol-issues] 20201112 [GitHub] [trafficcontrol] zrhoffman opened a new pull request #5278: Update Go version to 1.15.5https://lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd%40%3Cissues.trafficcontrol.apache.org%3Emailing-listx_refsource_MLIST
groups.google.comhttps://groups.google.com/g/golang-nuts/c/c-ssaaS7RMIx_refsource_CONFIRM
lists.fedoraproject.orgFEDORA-2020-864922e78ahttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO/vendor-advisoryx_refsource_FEDORA
security.netapp.comhttps://security.netapp.com/advisory/ntap-20201202-0004/x_refsource_CONFIRM
lists.fedoraproject.orgFEDORA-2020-e971480183https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP/vendor-advisoryx_refsource_FEDORA
www.arista.comhttps://www.arista.com/en/support/advisories-notices/security-advisories/12166-security-advisory-62x_refsource_MISC

07 Fixed in

AlmaLinux 8

cockpit-podman
Fixed

A version is affected if any line below covers it.
- Affected before 11-1.module_el8.5.0+108+00865455
- Affected before 11-1.module_el8.5.0+2635+e4386a39
conmon
Fixed

A version is affected if any line below covers it.
- Affected before 2:2.0.15-1.module_el8.5.0+108+00865455
- Affected before 2:2.0.15-1.module_el8.5.0+2635+e4386a39
container-selinux
Fixed

A version is affected if any line below covers it.
- Affected before 2:2.130.0-1.module_el8.5.0+108+00865455
- Affected before 2:2.130.0-1.module_el8.5.0+2635+e4386a39
containernetworking-plugins
Fixed

A version is affected if any line below covers it.
- Affected before 0.8.3-4.module_el8.5.0+108+00865455
- Affected before 0.8.3-4.module_el8.5.0+2635+e4386a39
containers-common
Fixed

A version is affected if any line below covers it.
- Affected before 1:0.1.41-4.module_el8.5.0+108+00865455
- Affected before 1:0.1.41-4.module_el8.5.0+2635+e4386a39
crit
Fixed

A version is affected if any line below covers it.
- Affected before 3.12-9.module_el8.3.0+2044+12421f43
- Affected before 3.12-9.module_el8.4.0+2496+12421f43
- Affected before 3.12-9.module_el8.5.0+119+9a9ec082
criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.12-9.module_el8.3.0+2044+12421f43
- Affected before 3.12-9.module_el8.4.0+2496+12421f43
- Affected before 3.12-9.module_el8.5.0+119+9a9ec082
fuse-overlayfs
Fixed

A version is affected if any line below covers it.
- Affected before 0.7.8-1.module_el8.5.0+108+00865455
- Affected before 0.7.8-1.module_el8.5.0+2635+e4386a39
python-podman-api
Fixed

A version is affected if any line below covers it.
- Affected before 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455
- Affected before 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
python3-criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.12-9.module_el8.3.0+2044+12421f43
- Affected before 3.12-9.module_el8.4.0+2496+12421f43
- Affected before 3.12-9.module_el8.5.0+119+9a9ec082
skopeo
Fixed

A version is affected if any line below covers it.
- Affected before 1:0.1.41-4.module_el8.5.0+108+00865455
- Affected before 1:0.1.41-4.module_el8.5.0+2635+e4386a39
skopeo-tests
Fixed

A version is affected if any line below covers it.
- Affected before 1:0.1.41-4.module_el8.5.0+108+00865455
- Affected before 1:0.1.41-4.module_el8.5.0+2635+e4386a39
slirp4netns
Fixed

A version is affected if any line below covers it.
- Affected before 0.4.2-3.git21fdece.module_el8.5.0+108+00865455
- Affected before 0.4.2-3.git21fdece.module_el8.5.0+2635+e4386a39
toolbox
Fixed

A version is affected if any line below covers it.
- Affected before 0.0.7-1.module_el8.5.0+108+00865455
- Affected before 0.0.7-1.module_el8.5.0+2635+e4386a39
udica
Fixed

A version is affected if any line below covers it.
- Affected before 0.2.1-2.module_el8.5.0+108+00865455
- Affected before 0.2.1-2.module_el8.5.0+2635+e4386a39

Arch Linux

go
Fixed in 2:1.15.5-1

Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.

CloudLinux 8

cockpit-podman
Fixed

A version is affected if any line below covers it.
- Affected before 11-1.module_el8.5.0+108+00865455
- Affected before 11-1.module_el8.5.0+2635+e4386a39
conmon
Fixed

A version is affected if any line below covers it.
- Affected before 2:2.0.15-1.module_el8.5.0+108+00865455
- Affected before 2:2.0.15-1.module_el8.5.0+2635+e4386a39
container-selinux
Fixed

A version is affected if any line below covers it.
- Affected before 2:2.130.0-1.module_el8.5.0+108+00865455
- Affected before 2:2.130.0-1.module_el8.5.0+2635+e4386a39
containernetworking-plugins
Fixed

A version is affected if any line below covers it.
- Affected before 0.8.3-4.module_el8.5.0+108+00865455
- Affected before 0.8.3-4.module_el8.5.0+2635+e4386a39
containers-common
Fixed

A version is affected if any line below covers it.
- Affected before 1:0.1.41-4.module_el8.5.0+108+00865455
- Affected before 1:0.1.41-4.module_el8.5.0+2635+e4386a39
crit
Fixed

A version is affected if any line below covers it.
- Affected before 3.12-9.module_el8.3.0+2044+12421f43
- Affected before 3.12-9.module_el8.4.0+2496+12421f43
- Affected before 3.12-9.module_el8.5.0+119+9a9ec082
criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.12-9.module_el8.3.0+2044+12421f43
- Affected before 3.12-9.module_el8.4.0+2496+12421f43
- Affected before 3.12-9.module_el8.5.0+119+9a9ec082
fuse-overlayfs
Fixed

A version is affected if any line below covers it.
- Affected before 0.7.8-1.module_el8.5.0+108+00865455
- Affected before 0.7.8-1.module_el8.5.0+2635+e4386a39
python-podman-api
Fixed

A version is affected if any line below covers it.
- Affected before 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455
- Affected before 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
python3-criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.12-9.module_el8.3.0+2044+12421f43
- Affected before 3.12-9.module_el8.4.0+2496+12421f43
- Affected before 3.12-9.module_el8.5.0+119+9a9ec082
skopeo
Fixed

A version is affected if any line below covers it.
- Affected before 1:0.1.41-4.module_el8.5.0+108+00865455
- Affected before 1:0.1.41-4.module_el8.5.0+2635+e4386a39
skopeo-tests
Fixed

A version is affected if any line below covers it.
- Affected before 1:0.1.41-4.module_el8.5.0+108+00865455
- Affected before 1:0.1.41-4.module_el8.5.0+2635+e4386a39
slirp4netns
Fixed

A version is affected if any line below covers it.
- Affected before 0.4.2-3.git21fdece.module_el8.5.0+108+00865455
- Affected before 0.4.2-3.git21fdece.module_el8.5.0+2635+e4386a39
toolbox
Fixed

A version is affected if any line below covers it.
- Affected before 0.0.7-1.module_el8.5.0+108+00865455
- Affected before 0.0.7-1.module_el8.5.0+2635+e4386a39
udica
Fixed

A version is affected if any line below covers it.
- Affected before 0.2.1-2.module_el8.5.0+108+00865455
- Affected before 0.2.1-2.module_el8.5.0+2635+e4386a39

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 11

golang-1.15
Fixed in 1.15.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

golang-1.14
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.