RHSA-2023:3366

Not all valid JavaScript whitespace characters are considered to be whitespace.

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.

A path traversal vulnerability exists in filepath.Clean on Windows.

Large handshake records may cause panics in crypto/tls.

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Templates containing actions in unquoted HTML attributes (e.g.

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.