TI-2023-10161 CVE-2023-24540 · GHSA-7qhm-5mxq-x7vp
Improper handling of JavaScript whitespace in html/template
Priority MEDIUM 52
Not all valid JavaScript whitespace characters are considered to be whitespace.
RHSA-2023:3323
go-toolset-1.19 and go-toolset-1.19-golang security update
Released 2023-05-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang-1.19.9-1.el7_9, go-toolset-1.19-golang-bin-1.19.9-1.el7_9, go-toolset-1.19-golang-docs-1.19.9-1.el7_9 +4
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang-1.19.9-1.el7_9, go-toolset-1.19-golang-bin-1.19.9-1.el7_9, go-toolset-1.19-golang-docs-1.19.9-1.el7_9 +4
Fixes 5 records
TI-2023-10159 CVE-2023-24538 · GHSA-v4m2-x4rp-hv22
Backticks not treated as string delimiters in html/template
Priority MEDIUM 47
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.
TI-2023-10158 CVE-2023-24537 · GHSA-fp86-2355-v99r
Infinite loop in parsing in go/scanner
Priority LOW 36
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.
TI-2023-13780 CVE-2023-29400 · GHSA-c9hr-fvm9-7c49
Improper handling of empty HTML attributes in html/template
Priority LOW 34
Templates containing actions in unquoted HTML attributes (e.g.
TI-2023-10160 CVE-2023-24539 · GHSA-3q6h-q44p-xw88
Improper sanitization of CSS values in html/template
Priority LOW 34
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.