CVE-2020-14040: 
NixOS vulnerability analysis and mitigation

CVE-2020-14040 affects the x/text package for Go versions before 0.3.3. The vulnerability was discovered in the encoding/unicode component and was disclosed on June 17, 2020. The affected component is the UTF-16 decoder implementation within the package (NVD).

The vulnerability exists in the encoding/unicode component where the UTF-16 decoder can enter an infinite loop. This occurs when a single byte is provided to a UTF16 decoder that is instantiated with UseBOM or ExpectBOM parameters, specifically when either the String function on the Decoder is called or the Decoder is passed to golang.org/x/text/transform.String. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause the program to crash or run out of memory due to the infinite loop condition. This results in a denial of service condition, affecting the availability of the system or application using the vulnerable component (NVD).

An attacker can trigger this vulnerability by providing a single byte to a UTF16 decoder that has been instantiated with specific parameters (UseBOM or ExpectBOM). The exploitation requires no special privileges or user interaction, making it relatively straightforward to execute (NVD).

The vulnerability has been fixed in version 0.3.3 of the x/text package. Users should upgrade to this version or later to mitigate the vulnerability. Red Hat has also released security updates for affected products, including go-toolset:rhel8 (Red Hat Security).