This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2023-3978 →
UBUNTU-CVE-2023-3978
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS att...
Original description
The description as published by the source.
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:16.04:LTS
golang-golang-x-net-dev
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2"}]}]
Ubuntu:Pro:16.04:LTS
juju-core
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-0ubuntu0.16.04.1+esm2"}]}]
Ubuntu:Pro:16.04:LTS
lxd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-0ubuntu1~16.04.4+esm2"}]}]
Ubuntu:Pro:18.04:LTS
lxd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-0ubuntu1~18.04.2+esm2"}]}]
Ubuntu:Pro:18.04:LTS
golang-golang-x-net-dev
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2"}]}]
Ubuntu:Pro:20.04:LTS
adsys
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2~20.04.2ubuntu0.1+esm1"}]}]
Ubuntu:Pro:20.04:LTS
golang-golang-x-net-dev
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2"}]}]
Ubuntu:22.04:LTS
golang-golang-x-net
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1"}]}]
Ubuntu:Pro:22.04:LTS
golang-golang-x-net
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report go.dev
- report pkg.go.dev
- report cve.org