CVE-2023-39319

Improper handling of special tags within script contexts in html/template

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.8"},{"introduced":"1.21.0"},{"fixed":"1.21.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2023-39319 golang-1.15
Ubuntu UBUNTU-CVE-2023-39319 golang-1.10

Références

advisory security.gentoo.org
advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev