CVE-2020-28852: 
NixOS vulnerability analysis and mitigation

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. The vulnerability, identified as CVE-2020-28852, was discovered in late 2020 and affects the x/text/language component which is supposed to be able to parse an HTTP Accept-Language header (NVD, Ubuntu).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue specifically occurs in the language.ParseAcceptLanguage function when processing BCP 47 language tags, resulting in a panic with the error message "slice bounds out of range [9:8]" (Github Issue, NetApp Advisory).

The vulnerability can lead to a Denial of Service (DoS) condition when processing malformed BCP 47 language tags. Since the vulnerability affects the language parsing functionality, any application using the affected x/text package for processing Accept-Language headers could be impacted (NetApp Advisory).

The vulnerability is remotely exploitable without requiring any authentication or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit. The vulnerability has been publicly discussed, though there are no known reports of exploitation in the wild (NVD).

The vulnerability was fixed in Go x/text version 0.3.5. Users are advised to upgrade to this version or later to address the issue. Various Linux distributions have also released patches for their respective packages, including Ubuntu which has provided fixes for affected versions in their repositories (Ubuntu Security Notice).