CVE-2023-39319

Name
CVE-2023-39319
Description
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
MISC https://pkg.go.dev/vuln/GO-2023-2043
MISC https://go.dev/cl/526157
MISC https://go.dev/issue/62197
Third Party Advisory https://security.netapp.com/advisory/ntap-20231020-0009/
https://security.gentoo.org/glsa/202311-09

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* go >= 1.21.0 < 1.21.1
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* go >= None < 1.20.8

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
go edge-community 1.21.1-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> fixed
go edge-community 1.21.0-r2 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.21.0-r1 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.21.0-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.7-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.6-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.5-r2 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.5-r1 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.5-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.4-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.3-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.2-r1 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.2-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20.1-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.20-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.19.5-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.19.4-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.19.3-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.19.2-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.19.1-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.18.5-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> possibly vulnerable
go edge-community 1.18.4-r0 None possibly vulnerable
go edge-community 1.18.1-r0 None possibly vulnerable
go edge-community 1.17.8-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.17.7-r0 None possibly vulnerable
go edge-community 1.17.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.17.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.17.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.17.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.17-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.16.7-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.16.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.16.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.16.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
go edge-community 1.16.2-r0 None possibly vulnerable
go edge-community 1.15.7-r0 None possibly vulnerable
go edge-community 1.15.5-r0 None possibly vulnerable
go edge-community 1.15.2-r0 None possibly vulnerable
go edge-community 1.15-r0 None possibly vulnerable
go edge-community 1.14.5-r0 None possibly vulnerable
go edge-community 1.13.7-r0 None possibly vulnerable
go edge-community 1.13.2-r0 None possibly vulnerable
go edge-community 1.13.1-r0 None possibly vulnerable
go edge-community 1.12.8-r0 None possibly vulnerable
go edge-community 1.11.5-r0 None possibly vulnerable
go edge-community 1.9.4-r0 None possibly vulnerable
go 3.22-community 1.21.1-r0 None fixed
go 3.22-community 1.20.7-r0 None possibly vulnerable
go 3.22-community 1.20.6-r0 None possibly vulnerable
go 3.22-community 1.20.5-r0 None possibly vulnerable
go 3.22-community 1.20.4-r0 None possibly vulnerable
go 3.22-community 1.20.3-r0 None possibly vulnerable
go 3.22-community 1.20.2-r0 None possibly vulnerable
go 3.22-community 1.20.1-r0 None possibly vulnerable
go 3.22-community 1.19.4-r0 None possibly vulnerable
go 3.22-community 1.19.2-r0 None possibly vulnerable
go 3.22-community 1.19.1-r0 None possibly vulnerable
go 3.22-community 1.18.5-r0 None possibly vulnerable
go 3.22-community 1.18.4-r0 None possibly vulnerable
go 3.22-community 1.18.1-r0 None possibly vulnerable
go 3.22-community 1.17.8-r0 None possibly vulnerable
go 3.22-community 1.17.7-r0 None possibly vulnerable
go 3.22-community 1.17.6-r0 None possibly vulnerable
go 3.22-community 1.17.3-r0 None possibly vulnerable
go 3.22-community 1.17.2-r0 None possibly vulnerable
go 3.22-community 1.17.1-r0 None possibly vulnerable
go 3.22-community 1.17-r0 None possibly vulnerable
go 3.22-community 1.16.7-r0 None possibly vulnerable
go 3.22-community 1.16.6-r0 None possibly vulnerable
go 3.22-community 1.16.5-r0 None possibly vulnerable
go 3.22-community 1.16.4-r0 None possibly vulnerable
go 3.22-community 1.16.2-r0 None possibly vulnerable
go 3.22-community 1.15.7-r0 None possibly vulnerable
go 3.22-community 1.15.5-r0 None possibly vulnerable
go 3.22-community 1.15.2-r0 None possibly vulnerable
go 3.22-community 1.15-r0 None possibly vulnerable
go 3.22-community 1.14.5-r0 None possibly vulnerable
go 3.22-community 1.13.7-r0 None possibly vulnerable
go 3.22-community 1.13.2-r0 None possibly vulnerable
go 3.22-community 1.13.1-r0 None possibly vulnerable
go 3.22-community 1.12.8-r0 None possibly vulnerable
go 3.22-community 1.11.5-r0 None possibly vulnerable
go 3.22-community 1.9.4-r0 None possibly vulnerable
go 3.21-community 1.21.1-r0 None fixed
go 3.20-community 1.21.1-r0 None fixed
go 3.19-community 1.21.1-r0 None fixed
go 3.18-community 1.20.8-r0 Sören Tempel <soeren+alpine@soeren-tempel.net> fixed