Skip to content
Fencer Vulns
high 7.5

CVE-2020-28362 json

Panic during division of very large numbers in math/big

published 2020-11-18 5 y ago modified 2026-09-08 2 mo ago also BIT-golang-2020-28362 , EUVD-2020-20822 , GO-2021-0069

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.9%
EPSS 3.9% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Patch / fix

  • bitnami golang 1.14.12, 1.15.5
  • go stdlib 1.14.12, 1.15.5
  • golang go 1.14.12, 1.15.5
  • golang-1.15 Debian 11 1.15.5-1

debian advisories DEBIAN-CVE-2020-28362

  • mcg openshift container storage 4.7 5.7.0-69.85e2026.5.7.el8
  • runc openshift 4.7 1.0.0-95.rhaos4.8.gitcd80260.el7
  • runc openshift 4.7 1.0.0-95.rhaos4.8.gitcd80260.el8
  • jenkins openshift 4.7 2.277.3.1620393611-1.el8
  • cri-tools openshift 4.7 1.20.0-2.el7
  • cri-tools openshift 4.7 1.20.0-2.el8
  • prometheus-promu openshift 4.7 0.5.0-3.git642a960.el8
  • golang-github-prometheus-promu openshift 4.7 0.5.0-3.git642a960.el8

red hat advisories RHSA-2021:2042RHSA-2021:1551RHSA-2021:1366RHSA-2020:5493RHSA-2021:0145RHSA-2020:5333

  • go1.14 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.14.12-1.26.1
  • go1.15 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.15.5-1.11.1

suse advisories SUSE-SU-2020:3369-1SUSE-SU-2020:3368-1

  • go1.14 openSUSE Tumbleweed 1.14.15-1.6
  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.15 openSUSE Leap 15.2 1.15.5-lp152.2.1
  • go1.14 openSUSE Leap 15.2 1.14.12-lp152.2.12.1
  • go1.14 openSUSE Leap 15.1 1.14.12-lp151.22.1

opensuse advisories openSUSE-SU-2024:10807-1openSUSE-SU-2024:10808-1openSUSE-SU-2020:2139-1openSUSE-SU-2020:2067-1openSUSE-SU-2020:2047-1

  • crit AlmaLinux 8 3.12-9.module_el8.3.0+2044+12421f43
  • crit AlmaLinux 8 3.12-9.module_el8.4.0+2496+12421f43
  • crit AlmaLinux 8 3.12-9.module_el8.5.0+119+9a9ec082
  • criu AlmaLinux 8 3.12-9.module_el8.4.0+2496+12421f43
  • criu AlmaLinux 8 3.12-9.module_el8.3.0+2044+12421f43
  • criu AlmaLinux 8 3.12-9.module_el8.5.0+119+9a9ec082
  • udica AlmaLinux 8 0.2.1-2.module_el8.5.0+108+00865455
  • udica AlmaLinux 8 0.2.1-2.module_el8.5.0+2635+e4386a39

almalinux advisories ALSA-2021:0706

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.15.5-r0

alpine advisories ALPINE-CVE-2020-28362

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.15.5-1

arch linux advisories AVG-1278

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-28362 updated cvss 7.5

golang: math/big: panic during recursive division of very large numbers

  • Red Hat OpenShift Serverless knative-serving knative-serving
    affected: no fix available
  • Red Hat OpenShift Service Mesh 1 ior, kiali, servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, +11 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, servicemesh-proxy, servicemesh-grafana, +6 more
    affected: no fix available
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, golang, libgcc, +20 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 podman, skopeo, buildah, grafana, grafana-loki, podman-tests, +21 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 go-toolset
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +4 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Container Storage 4 ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8
    affected: no fix available
show 16 more
  • Red Hat OpenShift Virtualization 1 virt-api, ember-csi, sriov-cni, multus-cni, kubevirt-cdi, virt-handler, +19 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Virtualization 2 virt-api, kubemacpool, virt-handler, bridge-marker, virt-launcher, virt-operator, +23 more
    affected: no fix available
  • Red Hat Storage 3 noobaa-operator-container, multi-cloud-object-gateway-cli
    affected: no fix planned “Will not fix”
  • Red Hat CNV 2.6 for RHEL 8 container-native-virtualization/vm-import-controller v2.6.0-25, container-native-virtualization/kubevirt-cpu-node-labeller v2.6.0-7, container-native-virtualization/vm-import-controller-rhel8 v2.6.0-25, container-native-virtualization/kubevirt-kvm-info-nfd-plugin v2.6.0-7, container-native-virtualization/kubevirt-cpu-model-nfd-plugin v2.6.0-9
    fixed: vendor fix RHSA-2021:0799
  • Red Hat Openshift Serverless 1.12 openshift-serverless-1/client-kn-rhel8 0.18.4-2, openshift-serverless-1/serving-queue-rhel8 0.18.2-3, openshift-serverless-1/eventing-mtping-rhel8 0.18.6-2, openshift-serverless-1/kourier-control-rhel8 0.18.0-2, openshift-serverless-1/serving-webhook-rhel8 0.18.2-3, openshift-serverless-1/eventing-webhook-rhel8 0.18.6-2, +20 more
    fixed: vendor fix RHSA-2021:0146
  • Red Hat OpenShift Service Mesh 2.0 kiali v1.24.4.redhat2-1.el8
    fixed: vendor fix RHBA-2021:0482
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.14 1.14.12-1.el7_9, go-toolset-1.14-build 1.14.12-1.el7_9, go-toolset-1.14-golang 1.14.12-1.el7_9, go-toolset-1.14-runtime 1.14.12-1.el7_9, go-toolset-1.14-golang-bin 1.14.12-1.el7_9, go-toolset-1.14-golang-src 1.14.12-1.el7_9, +3 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.14 1.14.12-1.el7_9, go-toolset-1.14-build 1.14.12-1.el7_9, go-toolset-1.14-golang 1.14.12-1.el7_9, go-toolset-1.14-runtime 1.14.12-1.el7_9, go-toolset-1.14-golang-bin 1.14.12-1.el7_9, go-toolset-1.14-golang-src 1.14.12-1.el7_9, +3 more
    fixed: vendor fix RHSA-2020:5333
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.12-9.module+el8.3.0+10188+4c10031c, criu 3.12-9.module+el8.3.0+10188+4c10031c, delve 1.4.1-1.module+el8.3.0+7840+63dfb1ed, udica 0.2.1-2.module+el8.3.0+10188+4c10031c, conmon 2.0.15-1.module+el8.3.0+10188+4c10031c, golang 1.14.12-1.module+el8.3.0+8784+380394dc, +24 more
    fixed: vendor fix RHSA-2021:0706
  • Red Hat OpenShift Container Platform 4.6 skopeo 1.1.1-3.rhaos4.6.el8, skopeo-tests 1.1.1-3.rhaos4.6.el8, containers-common 1.1.1-3.rhaos4.6.el8, cri-o 1.19.1-2.rhaos4.6.git2af9ecf.el8, openshift4/ose-cli v4.6.0-202101090040.p0, openshift4/ose-pod v4.6.0-202101120925.p0, +147 more
    fixed: vendor fix RHSA-2021:0038
  • Red Hat OpenShift Container Platform 4.7 cri-tools 1.20.0-2.el7, cri-tools 1.20.0-2.el8, runc 1.0.0-95.rhaos4.8.gitcd80260.el7, runc 1.0.0-95.rhaos4.8.gitcd80260.el8, prometheus-promu 0.5.0-3.git642a960.el8, ignition 2.9.0-2.rhaos4.7.git1d56dc8.el8, +3 more
    fixed: vendor fix RHSA-2021:1551
  • Red Hat OpenShift Container Storage 4.6 on RHEL-8 ocs4/cephcsi-rhel8 4.6-54.49cf5efdd.release_4.6, ocs4/rook-ceph-rhel8-operator 4.6-82.8c7ed584.release_4.6
    fixed: vendor fix RHBA-2021:0305
  • Red Hat OpenShift Container Storage 4.7 on RHEL-8 mcg 5.7.0-69.85e2026.5.7.el8, ocs4/mcg-rhel8-operator 5.7.0-69.85e2026.5.7
    fixed: vendor fix RHSA-2021:2042
  • Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel8 1.17.9-7, distributed-tracing/jaeger-query-rhel8 1.17.9-7, distributed-tracing/jaeger-ingester-rhel8 1.17.9-7, distributed-tracing/jaeger-rhel8-operator 1.17.9-7, distributed-tracing/jaeger-collector-rhel8 1.17.9-7, distributed-tracing/jaeger-all-in-one-rhel8 1.17.9-7
    fixed: vendor fix RHSA-2021:2532
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.4-18, distributed-tracing/jaeger-query-rhel8 1.20.4-18, distributed-tracing/jaeger-ingester-rhel8 1.20.4-17, distributed-tracing/jaeger-rhel8-operator 1.20.4-18, distributed-tracing/jaeger-collector-rhel8 1.20.4-18, distributed-tracing/jaeger-all-in-one-rhel8 1.20.4-18
    fixed: vendor fix RHSA-2021:2543
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.18.4-2.el8
    fixed: vendor fix RHSA-2021:0145
  • Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-agent-rhel7, distributed-tracing/jaeger-rhel7-operator, distributed-tracing/jaeger-all-in-one-rhel7 Red Hat OpenShift Service Mesh 2.0 servicemesh 2.0.2-1.el8, servicemesh-cni 2.0.2-2.el8, servicemesh-mixc 2.0.2-1.el8, servicemesh-mixs 2.0.2-1.el8, servicemesh-proxy 2.0.2-1.el8, servicemesh-istioctl 2.0.2-1.el8, +7 more Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, prometheus-node-exporter Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 8 libasan6, gcc-toolset-10-gcc, gcc-toolset-10-gcc-c++, gcc-toolset-10-gcc-gfortran, gcc-toolset-10-gcc-gdb-plugin Red Hat Enterprise Linux 9 grafana, grafana-selinux
    +8 more products
    Red Hat OpenShift Container Platform 3.11 apb, cri-o, podman, heapster, cri-tools, prometheus, +55 more Red Hat OpenShift Container Platform 4 buildah, buildah-tests, openshift4/ose-etcd, machine-config-daemon, openshift4/cnf-tests-rhel8, openshift4/performance-addon-rhel8-operator Red Hat OpenShift Container Platform 4.6 cri-o 1.19.1-4.rhaos4.6.git3846aab.el8, jenkins-2-plugins 4.6.1608634578-1.el7, jenkins-2-plugins 4.6.1609853716-1.el8, openshift4/ose-etcd v4.6.0-202101090040.p0, openshift4/compliance-content-rhel8 v4.6.0-25, openshift4/ose-deployer v4.6.0-202101090040.p0, +67 more Red Hat OpenShift Container Platform 4.7 jq 1.6-2.el7, jq 1.6-2.el8, clevis 15-1.el8, faq 0.0.6-5.el8, bootupd 0.2.5-2.el8, ostree 2020.7-1.el8, +443 more Red Hat OpenShift Container Storage 4.6 on RHEL-8 ocs4/ocs-operator-bundle 4.6.2-1, ocs4/mcg-core-rhel8 5.6.0-42.6a01c5fc0.5.6, ocs4/mcg-rhel8-operator 5.6.0-41.2279a46.5.6, ocs4/ocs-rhel8-operator 4.6-78.3b7455e4.release_4.6, ocs4/ocs-must-gather-rhel8 4.6-78.3b7455e4.release_4.6 Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/ocs-operator-bundle 4.7.0-11, ocs4/mcg-core-rhel8 5.7.0-60.2c1fdb0.5.7, ocs4/cephcsi-rhel8 4.7-102.5c44836.release_4.7, ocs4/ocs-rhel8-operator 4.7-174.7f14177.release_4.7, ocs4/ocs-must-gather-rhel8 4.7-174.7f14177.release_4.7, ocs4/rook-ceph-rhel8-operator 4.7-140.49a6fcf.release_4.7 Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-es-rollover-rhel8 1.17.9-4, distributed-tracing/jaeger-es-index-cleaner-rhel8 1.17.9-5 Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-es-rollover-rhel8 1.20.4-7, distributed-tracing/jaeger-es-index-cleaner-rhel8 1.20.4-7
    not affected: vulnerable code not present

2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.86% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.14.12
>=1.15.0, <1.15.5
1.14.12
1.15.5
go stdlib
>=1.14.0-0, <1.14.12
>=1.15.0-0, <1.15.5
1.14.12
1.15.5

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.