Important: golang

2023-10-1613:45:00

alas.aws.amazon.com

golang

html/template

http/2

xss

denial of service

cve-2023-39318

cve-2023-39319

cve-2023-39323

cve-2023-39325

cve-2023-44487

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.816

Percentile

98.4%

JSON

Issue Overview:

2024-01-03: CVE-2023-39319 was added to this advisory.

2023-10-30: CVE-2023-39318 was added to this advisory.

The html/template package does not properly handle HTML-like “” comment tokens, nor hashbang “#!” comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack. (CVE-2023-39318)

The html/template package does not apply the proper rules for handling occurrences of “<script”, "

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64golang< 1.20.10-1.amzn2.0.1golang-1.20.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64golang-bin< 1.20.10-1.amzn2.0.1golang-bin-1.20.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64golang-shared< 1.20.10-1.amzn2.0.1golang-shared-1.20.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2noarchgolang-docs< 1.20.10-1.amzn2.0.1golang-docs-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux2noarchgolang-misc< 1.20.10-1.amzn2.0.1golang-misc-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux2noarchgolang-tests< 1.20.10-1.amzn2.0.1golang-tests-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux2noarchgolang-src< 1.20.10-1.amzn2.0.1golang-src-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux2x86_64golang< 1.20.10-1.amzn2.0.1golang-1.20.10-1.amzn2.0.1.x86_64.rpm
Amazon Linux2x86_64golang-bin< 1.20.10-1.amzn2.0.1golang-bin-1.20.10-1.amzn2.0.1.x86_64.rpm
Amazon Linux2x86_64golang-shared< 1.20.10-1.amzn2.0.1golang-shared-1.20.10-1.amzn2.0.1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	golang	< 1.20.10-1.amzn2.0.1	golang-1.20.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux	2	aarch64	golang-bin	< 1.20.10-1.amzn2.0.1	golang-bin-1.20.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux	2	aarch64	golang-shared	< 1.20.10-1.amzn2.0.1	golang-shared-1.20.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux	2	noarch	golang-docs	< 1.20.10-1.amzn2.0.1	golang-docs-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux	2	noarch	golang-misc	< 1.20.10-1.amzn2.0.1	golang-misc-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux	2	noarch	golang-tests	< 1.20.10-1.amzn2.0.1	golang-tests-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux	2	noarch	golang-src	< 1.20.10-1.amzn2.0.1	golang-src-1.20.10-1.amzn2.0.1.noarch.rpm
Amazon Linux	2	x86_64	golang	< 1.20.10-1.amzn2.0.1	golang-1.20.10-1.amzn2.0.1.x86_64.rpm
Amazon Linux	2	x86_64	golang-bin	< 1.20.10-1.amzn2.0.1	golang-bin-1.20.10-1.amzn2.0.1.x86_64.rpm
Amazon Linux	2	x86_64	golang-shared	< 1.20.10-1.amzn2.0.1	golang-shared-1.20.10-1.amzn2.0.1.x86_64.rpm