Bug 2196027 (CVE-2023-24540) - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
Summary: CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
Keywords:
Status: NEW
Alias: CVE-2023-24540
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2196629 2196630 2203101 2203102 2203103 2203104 2203105 2203106 2203107 2203108 2203109 2203110 2203111 2203112 2203113 2203114 2203116 2203117 2203118 2203119 2203120 2203121 2203122 2203123 2203126 2203127 2203128 2203129 2203130 2203260 2203261 2204471 2204472 2204473 2204474 2204475 2204476 2204477 2207502 2207503 2207504 2207505 2207506 2207507 2207508 2207509 2207510 2207511 2207512 2207513 2207514 2207515 2207518 2207519 2207520 2207521 2207522 2207523 2207525 2207526 2208521 2208523 2208525 2208539 2208549 2209068 2221850
Blocks: 2193514
TreeView+ depends on / blocked
 
Reported: 2023-05-07 16:35 UTC by Anten Skrabec
Modified: 2024-04-02 15:28 UTC (History)
128 users (show)

Fixed In Version: golang 1.19.9, golang 1.20.4
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:3338 0 None None None 2023-05-29 01:09:22 UTC
Red Hat Product Errata RHBA-2023:3492 0 None None None 2023-06-06 15:17:48 UTC
Red Hat Product Errata RHBA-2023:3554 0 None None None 2023-06-08 20:33:53 UTC
Red Hat Product Errata RHBA-2023:4485 0 None None None 2023-08-03 23:22:30 UTC
Red Hat Product Errata RHSA-2023:3318 0 None None None 2023-05-25 07:53:53 UTC
Red Hat Product Errata RHSA-2023:3319 0 None None None 2023-05-25 08:01:30 UTC
Red Hat Product Errata RHSA-2023:3323 0 None None None 2023-05-25 12:26:22 UTC
Red Hat Product Errata RHSA-2023:3366 0 None None None 2023-06-07 02:02:31 UTC
Red Hat Product Errata RHSA-2023:3367 0 None None None 2023-06-07 01:51:03 UTC
Red Hat Product Errata RHSA-2023:3379 0 None None None 2023-05-31 11:17:05 UTC
Red Hat Product Errata RHSA-2023:3409 0 None None None 2023-06-07 21:17:16 UTC
Red Hat Product Errata RHSA-2023:3410 0 None None None 2023-06-07 20:59:46 UTC
Red Hat Product Errata RHSA-2023:3415 0 None None None 2023-05-31 19:38:19 UTC
Red Hat Product Errata RHSA-2023:3435 0 None None None 2023-06-05 09:29:15 UTC
Red Hat Product Errata RHSA-2023:3445 0 None None None 2023-06-05 14:08:26 UTC
Red Hat Product Errata RHSA-2023:3545 0 None None None 2023-06-14 04:21:40 UTC
Red Hat Product Errata RHSA-2023:3612 0 None None None 2023-06-23 04:39:58 UTC
Red Hat Product Errata RHSA-2023:3624 0 None None None 2023-06-15 09:48:18 UTC
Red Hat Product Errata RHSA-2023:3644 0 None None None 2023-06-15 20:55:55 UTC
Red Hat Product Errata RHSA-2023:3905 0 None None None 2023-06-28 15:43:01 UTC
Red Hat Product Errata RHSA-2023:3910 0 None None None 2023-07-06 02:57:48 UTC
Red Hat Product Errata RHSA-2023:3911 0 None None None 2023-07-06 02:33:03 UTC
Red Hat Product Errata RHSA-2023:3914 0 None None None 2023-07-06 02:44:37 UTC
Red Hat Product Errata RHSA-2023:3915 0 None None None 2023-07-06 02:22:47 UTC
Red Hat Product Errata RHSA-2023:3918 0 None None None 2023-06-29 00:59:26 UTC
Red Hat Product Errata RHSA-2023:4289 0 None None None 2023-07-27 00:53:34 UTC
Red Hat Product Errata RHSA-2023:4335 0 None None None 2023-08-08 00:36:40 UTC
Red Hat Product Errata RHSA-2023:4420 0 None None None 2023-08-01 14:36:00 UTC
Red Hat Product Errata RHSA-2023:4421 0 None None None 2023-08-01 14:51:37 UTC
Red Hat Product Errata RHSA-2023:4470 0 None None None 2023-08-03 14:12:36 UTC
Red Hat Product Errata RHSA-2023:4627 0 None None None 2023-08-14 01:02:59 UTC
Red Hat Product Errata RHSA-2023:4664 0 None None None 2023-08-16 14:09:50 UTC
Red Hat Product Errata RHSA-2023:5376 0 None None None 2023-09-27 14:22:45 UTC
Red Hat Product Errata RHSA-2023:5421 0 None None None 2023-10-03 18:50:09 UTC
Red Hat Product Errata RHSA-2023:5442 0 None None None 2023-10-04 13:07:56 UTC
Red Hat Product Errata RHSA-2023:5947 0 None None None 2023-10-26 00:47:55 UTC
Red Hat Product Errata RHSA-2023:6346 0 None None None 2023-11-07 08:13:47 UTC
Red Hat Product Errata RHSA-2023:6363 0 None None None 2023-11-07 08:14:20 UTC
Red Hat Product Errata RHSA-2023:6402 0 None None None 2023-11-07 08:16:09 UTC
Red Hat Product Errata RHSA-2023:6473 0 None None None 2023-11-07 08:17:22 UTC
Red Hat Product Errata RHSA-2023:6474 0 None None None 2023-11-07 08:17:54 UTC
Red Hat Product Errata RHSA-2023:6938 0 None None None 2023-11-14 15:16:47 UTC
Red Hat Product Errata RHSA-2023:6939 0 None None None 2023-11-14 15:17:37 UTC

Description Anten Skrabec 2023-05-07 16:35:35 UTC 
Not all valid JavaScript whitespace characters were considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
Comment 3 Anten Skrabec 2023-05-09 15:32:28 UTC 
Created golang tracking bugs for this issue:

Affects: epel-all [bug 2196629]
Affects: fedora-all [bug 2196630]
Comment 7 Doug Hellmann 2023-05-11 12:43:39 UTC 
Anten, is there a link to the upstream report? It's not clear from the description here in bugzilla how to reproduce the problem so I can't tell if MicroShift is actually affected.
Comment 8 TEJ RATHI 2023-05-11 13:06:37 UTC 
References:
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
Go issue https://go.dev/issue/59721

Commits:
https://github.com/golang/go/commit/a32232cb18ed07496ec77c1cf2dcefa1cb0ac057 [Master]
https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797 [release-branch.go1.19]
https://github.com/golang/go/commit/4a28cad66655ee01c6e944271e23c33cab021765 [release-branch.go1.20]
Comment 19 errata-xmlrpc 2023-05-25 07:53:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3318 https://access.redhat.com/errata/RHSA-2023:3318
Comment 20 errata-xmlrpc 2023-05-25 08:01:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3319 https://access.redhat.com/errata/RHSA-2023:3319
Comment 21 errata-xmlrpc 2023-05-25 12:26:15 UTC 
This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2023:3323 https://access.redhat.com/errata/RHSA-2023:3323
Comment 22 errata-xmlrpc 2023-05-31 11:16:59 UTC 
This issue has been addressed in the following products:

  RHACS-3.73-RHEL-8

Via RHSA-2023:3379 https://access.redhat.com/errata/RHSA-2023:3379
Comment 23 errata-xmlrpc 2023-05-31 19:38:14 UTC 
This issue has been addressed in the following products:

  RHACS-4.0-RHEL-8

Via RHSA-2023:3415 https://access.redhat.com/errata/RHSA-2023:3415
Comment 25 errata-xmlrpc 2023-06-05 09:29:08 UTC 
This issue has been addressed in the following products:

  RHACS-3.74-RHEL-8

Via RHSA-2023:3435 https://access.redhat.com/errata/RHSA-2023:3435
Comment 26 errata-xmlrpc 2023-06-05 14:08:19 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2023:3445 https://access.redhat.com/errata/RHSA-2023:3445
Comment 27 errata-xmlrpc 2023-06-07 01:50:57 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3367 https://access.redhat.com/errata/RHSA-2023:3367
Comment 28 errata-xmlrpc 2023-06-07 02:02:26 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3366 https://access.redhat.com/errata/RHSA-2023:3366
Comment 29 errata-xmlrpc 2023-06-07 20:59:41 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2023:3410 https://access.redhat.com/errata/RHSA-2023:3410
Comment 30 errata-xmlrpc 2023-06-07 21:17:11 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2023:3409 https://access.redhat.com/errata/RHSA-2023:3409
Comment 32 errata-xmlrpc 2023-06-14 04:21:35 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2023:3545 https://access.redhat.com/errata/RHSA-2023:3545
Comment 35 errata-xmlrpc 2023-06-15 09:48:12 UTC 
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2023:3624 https://access.redhat.com/errata/RHSA-2023:3624
Comment 36 errata-xmlrpc 2023-06-15 20:55:49 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.4 for RHEL 8

Via RHSA-2023:3644 https://access.redhat.com/errata/RHSA-2023:3644
Comment 37 errata-xmlrpc 2023-06-23 04:39:53 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3612 https://access.redhat.com/errata/RHSA-2023:3612
Comment 38 errata-xmlrpc 2023-06-28 15:42:56 UTC 
This issue has been addressed in the following products:

  NETWORK-OBSERVABILITY-1.3.0-RHEL-9

Via RHSA-2023:3905 https://access.redhat.com/errata/RHSA-2023:3905
Comment 39 errata-xmlrpc 2023-06-29 00:59:22 UTC 
This issue has been addressed in the following products:

  OADP-1.1-RHEL-8

Via RHSA-2023:3918 https://access.redhat.com/errata/RHSA-2023:3918
Comment 40 errata-xmlrpc 2023-07-06 02:22:43 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11

Via RHSA-2023:3915 https://access.redhat.com/errata/RHSA-2023:3915
Comment 41 errata-xmlrpc 2023-07-06 02:32:57 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2023:3911 https://access.redhat.com/errata/RHSA-2023:3911
Comment 42 errata-xmlrpc 2023-07-06 02:44:31 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11

Via RHSA-2023:3914 https://access.redhat.com/errata/RHSA-2023:3914
Comment 43 errata-xmlrpc 2023-07-06 02:57:44 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2023:3910 https://access.redhat.com/errata/RHSA-2023:3910
Comment 45 Debarshi Ray 2023-07-10 15:37:11 UTC 
Were the bugs for this CVE created correctly?

I got bugs RHEL 8 bugs for toolbox for both the rolling (bug 2207514) and 4.0 (bug 2207509) module streams, but none for RHEL 9.  In comparison, I found a RHEL 8 podman bug for the 4.0 module stream (bug 2207507) and one for RHEL 9 (bug 2207522).  I also found a RHEL 9 bug for golang (bug 2204477).

So, it seems like RHEL 9 is affected, but then why is there no RHEL 9 toolbox bug?  There's no difference in toolbox across RHEL 8 and 9 that could be relevant to this CVE.
Comment 46 Anten Skrabec 2023-07-10 16:59:08 UTC 
@trathi: see comment #45 above about RHEL affects
Comment 53 errata-xmlrpc 2023-07-27 00:53:28 UTC 
This issue has been addressed in the following products:

  OADP-1.0-RHEL-8

Via RHSA-2023:4289 https://access.redhat.com/errata/RHSA-2023:4289
Comment 54 errata-xmlrpc 2023-08-01 14:35:55 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-4.12
  RHEL-7-CNV-4.12

Via RHSA-2023:4420 https://access.redhat.com/errata/RHSA-2023:4420
Comment 55 errata-xmlrpc 2023-08-01 14:51:31 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-4.12

Via RHSA-2023:4421 https://access.redhat.com/errata/RHSA-2023:4421
Comment 58 errata-xmlrpc 2023-08-03 14:12:30 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.3 for RHEL 8

Via RHSA-2023:4470 https://access.redhat.com/errata/RHSA-2023:4470
Comment 59 errata-xmlrpc 2023-08-08 00:36:34 UTC 
This issue has been addressed in the following products:

  CERT-MANAGER-1.10-RHEL-9

Via RHSA-2023:4335 https://access.redhat.com/errata/RHSA-2023:4335
Comment 62 errata-xmlrpc 2023-08-14 01:02:53 UTC 
This issue has been addressed in the following products:

  MTA-6.2-RHEL-9
  MTA-6.2-RHEL-8

Via RHSA-2023:4627 https://access.redhat.com/errata/RHSA-2023:4627
Comment 63 errata-xmlrpc 2023-08-16 14:09:44 UTC 
This issue has been addressed in the following products:

  RHEL-9-CNV-4.13

Via RHSA-2023:4664 https://access.redhat.com/errata/RHSA-2023:4664
Comment 64 errata-xmlrpc 2023-09-27 14:22:40 UTC 
This issue has been addressed in the following products:

  RHODF-4.13-RHEL-9

Via RHSA-2023:5376 https://access.redhat.com/errata/RHSA-2023:5376
Comment 65 errata-xmlrpc 2023-10-03 18:50:04 UTC 
This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.3 for RHEL 8

Via RHSA-2023:5421 https://access.redhat.com/errata/RHSA-2023:5421
Comment 66 errata-xmlrpc 2023-10-04 13:07:49 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.8 for RHEL 8

Via RHSA-2023:5442 https://access.redhat.com/errata/RHSA-2023:5442
Comment 67 errata-xmlrpc 2023-10-26 00:47:49 UTC 
This issue has been addressed in the following products:

  RODOO-1.0-RHEL-8

Via RHSA-2023:5947 https://access.redhat.com/errata/RHSA-2023:5947
Comment 68 errata-xmlrpc 2023-11-07 08:13:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6346 https://access.redhat.com/errata/RHSA-2023:6346
Comment 69 errata-xmlrpc 2023-11-07 08:14:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6363 https://access.redhat.com/errata/RHSA-2023:6363
Comment 70 errata-xmlrpc 2023-11-07 08:16:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6402 https://access.redhat.com/errata/RHSA-2023:6402
Comment 71 errata-xmlrpc 2023-11-07 08:17:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6473 https://access.redhat.com/errata/RHSA-2023:6473
Comment 72 errata-xmlrpc 2023-11-07 08:17:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6474 https://access.redhat.com/errata/RHSA-2023:6474
Comment 73 errata-xmlrpc 2023-11-14 15:16:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:6938 https://access.redhat.com/errata/RHSA-2023:6938
Comment 74 errata-xmlrpc 2023-11-14 15:17:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:6939 https://access.redhat.com/errata/RHSA-2023:6939
Note You need to log in before you can comment on or make changes to this bug.