Bug 2196026 (CVE-2023-24539) - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
Summary: CVE-2023-24539 golang: html/template: improper sanitization of CSS values
Keywords:
Status: NEW
Alias: CVE-2023-24539
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2196482 2196483 2196485 2196487 2196489 2196490 2203234 2203250 2203251 2207505 2207506 2207507 2207508 2207509 2207510 2207511 2207512 2207513 2207514 2207518 2207519 2207522 2207523 2221850 2196470 2196471 2196481 2196484 2196486 2196488 2196491 2196492 2203249 2207502 2207503 2207504 2207515 2207520 2207521
Blocks: 2193514
TreeView+ depends on / blocked
 
Reported: 2023-05-07 16:20 UTC by Anten Skrabec
Modified: 2023-08-16 14:09 UTC (History)
136 users (show)

Fixed In Version: golang 1.19.9, golang 1.20.4
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if executed with untrusted input.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3323 0 None None None 2023-05-25 12:26:09 UTC
Red Hat Product Errata RHSA-2023:3367 0 None None None 2023-06-07 01:51:04 UTC
Red Hat Product Errata RHSA-2023:3415 0 None None None 2023-05-31 19:38:19 UTC
Red Hat Product Errata RHSA-2023:3435 0 None None None 2023-06-05 09:29:04 UTC
Red Hat Product Errata RHSA-2023:3445 0 None None None 2023-06-05 14:08:22 UTC
Red Hat Product Errata RHSA-2023:3540 0 None None None 2023-06-13 15:32:37 UTC
Red Hat Product Errata RHSA-2023:3905 0 None None None 2023-06-28 15:43:03 UTC
Red Hat Product Errata RHSA-2023:3918 0 None None None 2023-06-29 00:59:28 UTC
Red Hat Product Errata RHSA-2023:4003 0 None None None 2023-07-10 08:51:40 UTC
Red Hat Product Errata RHSA-2023:4093 0 None None None 2023-07-20 17:29:00 UTC
Red Hat Product Errata RHSA-2023:4293 0 None None None 2023-07-27 01:14:05 UTC
Red Hat Product Errata RHSA-2023:4335 0 None None None 2023-08-08 00:36:39 UTC
Red Hat Product Errata RHSA-2023:4459 0 None None None 2023-08-08 11:30:19 UTC
Red Hat Product Errata RHSA-2023:4470 0 None None None 2023-08-03 14:12:36 UTC
Red Hat Product Errata RHSA-2023:4472 0 None None None 2023-08-03 15:51:34 UTC
Red Hat Product Errata RHSA-2023:4627 0 None None None 2023-08-14 01:02:57 UTC
Red Hat Product Errata RHSA-2023:4664 0 None None None 2023-08-16 14:09:49 UTC

Description Anten Skrabec 2023-05-07 16:20:32 UTC 
Angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in unexpectedly closing the CSS context and allowing for injection of unexpected HMTL, if executed with untrusted input.
Comment 2 Anten Skrabec 2023-05-09 09:56:41 UTC 
Created golang tracking bugs for this issue:

Affects: epel-all [bug 2196470]
Affects: fedora-all [bug 2196471]
Comment 8 TEJ RATHI 2023-05-11 13:04:40 UTC 
References:
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
Go issue https://go.dev/issue/59720

Commits:
https://github.com/golang/go/commit/8673ca81e5340b87709db2d9749c92a3bf925df1 [Master]
https://github.com/golang/go/commit/e49282327b05192e46086bf25fd3ac691205fe80 [release-branch.go1.19]
https://github.com/golang/go/commit/090590fdccc8442728aa31601927da1bf2ef1288 [release-branch.go1.20]
Comment 20 errata-xmlrpc 2023-05-25 12:26:03 UTC 
This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2023:3323 https://access.redhat.com/errata/RHSA-2023:3323
Comment 21 errata-xmlrpc 2023-05-31 19:38:14 UTC 
This issue has been addressed in the following products:

  RHACS-4.0-RHEL-8

Via RHSA-2023:3415 https://access.redhat.com/errata/RHSA-2023:3415
Comment 23 errata-xmlrpc 2023-06-05 09:28:58 UTC 
This issue has been addressed in the following products:

  RHACS-3.74-RHEL-8

Via RHSA-2023:3435 https://access.redhat.com/errata/RHSA-2023:3435
Comment 24 errata-xmlrpc 2023-06-05 14:08:17 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2023:3445 https://access.redhat.com/errata/RHSA-2023:3445
Comment 25 errata-xmlrpc 2023-06-07 01:50:57 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3367 https://access.redhat.com/errata/RHSA-2023:3367
Comment 26 errata-xmlrpc 2023-06-13 15:32:31 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3540 https://access.redhat.com/errata/RHSA-2023:3540
Comment 29 errata-xmlrpc 2023-06-28 15:42:56 UTC 
This issue has been addressed in the following products:

  NETWORK-OBSERVABILITY-1.3.0-RHEL-9

Via RHSA-2023:3905 https://access.redhat.com/errata/RHSA-2023:3905
Comment 30 errata-xmlrpc 2023-06-29 00:59:22 UTC 
This issue has been addressed in the following products:

  OADP-1.1-RHEL-8

Via RHSA-2023:3918 https://access.redhat.com/errata/RHSA-2023:3918
Comment 32 errata-xmlrpc 2023-07-10 08:51:34 UTC 
This issue has been addressed in the following products:

  Service Interconnect 1 for RHEL 8
  Service Interconnect 1 for RHEL 9

Via RHSA-2023:4003 https://access.redhat.com/errata/RHSA-2023:4003
Comment 33 Debarshi Ray 2023-07-10 15:28:52 UTC 
Were the bugs for this CVE created correctly?

I got bugs RHEL 8 bugs for toolbox for both the rolling (bug 2207514) and 4.0 (bug 2207509) module streams, but none for RHEL 9.  In comparison, I found a RHEL 8 podman bug for the 4.0 module stream (bug 2207507) and one for RHEL 9 (bug 2207522).  I also found a RHEL 9 bug for golang (bug 2203251).

So, it seems like RHEL 9 is affected, but then why is there no RHEL 9 toolbox bug?  There's no difference in toolbox across RHEL 8 and 9 that could be relevant to this CVE.
Comment 42 errata-xmlrpc 2023-07-20 17:28:56 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13
  Ironic content for Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:4093 https://access.redhat.com/errata/RHSA-2023:4093
Comment 43 errata-xmlrpc 2023-07-27 01:13:59 UTC 
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2023:4293 https://access.redhat.com/errata/RHSA-2023:4293
Comment 46 errata-xmlrpc 2023-08-03 14:12:30 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.3 for RHEL 8

Via RHSA-2023:4470 https://access.redhat.com/errata/RHSA-2023:4470
Comment 47 errata-xmlrpc 2023-08-03 15:51:29 UTC 
This issue has been addressed in the following products:

  RHOSS-1.29-RHEL-8

Via RHSA-2023:4472 https://access.redhat.com/errata/RHSA-2023:4472
Comment 48 errata-xmlrpc 2023-08-08 00:36:33 UTC 
This issue has been addressed in the following products:

  CERT-MANAGER-1.10-RHEL-9

Via RHSA-2023:4335 https://access.redhat.com/errata/RHSA-2023:4335
Comment 49 errata-xmlrpc 2023-08-08 11:30:13 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:4459 https://access.redhat.com/errata/RHSA-2023:4459
Comment 50 errata-xmlrpc 2023-08-14 01:02:53 UTC 
This issue has been addressed in the following products:

  MTA-6.2-RHEL-9
  MTA-6.2-RHEL-8

Via RHSA-2023:4627 https://access.redhat.com/errata/RHSA-2023:4627
Comment 51 errata-xmlrpc 2023-08-16 14:09:42 UTC 
This issue has been addressed in the following products:

  RHEL-9-CNV-4.13

Via RHSA-2023:4664 https://access.redhat.com/errata/RHSA-2023:4664
Note You need to log in before you can comment on or make changes to this bug.