CVE-2023-39319

Improper handling of special tags within script contexts in html/template

Summary

Original description

The description as published by the source.

The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.8"},{"introduced":"1.21.0"},{"fixed":"1.21.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-39319 golang-1.15
Ubuntu UBUNTU-CVE-2023-39319 golang-1.10

References

advisory security.gentoo.org
advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev