TI-2023-10159 CVE-2023-24538 · GHSA-v4m2-x4rp-hv22
Backticks not treated as string delimiters in html/template
Priority MEDIUM 47
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.
RHSA-2023:3540
OpenShift Container Platform 4.13.3 bug fix and security update
Released 2023-06-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.13 microshift-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9, microshift-networking-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9, microshift-release-info-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9 +1
Fixes 6 records
TI-2023-10155 CVE-2023-24534 · GHSA-8v5j-pwr7-w5f8
Excessive memory allocation in net/http and net/textproto
Priority LOW 37
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.
TI-2023-10158 CVE-2023-24537 · GHSA-fp86-2355-v99r
Infinite loop in parsing in go/scanner
Priority LOW 36
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.
TI-2023-10157 CVE-2023-24536 · GHSA-9f7g-gqwh-jpf5
Excessive resource consumption in net/http, net/textproto and mime/multipart
Priority LOW 36
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts.
TI-2023-13780 CVE-2023-29400 · GHSA-c9hr-fvm9-7c49
Improper handling of empty HTML attributes in html/template
Priority LOW 34
Templates containing actions in unquoted HTML attributes (e.g.
TI-2023-10160 CVE-2023-24539 · GHSA-3q6h-q44p-xw88
Improper sanitization of CSS values in html/template
Priority LOW 34
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.