| id: GO-2023-2043 |
| modules: |
| - module: std |
| versions: |
| - fixed: 1.20.8 |
| - introduced: 1.21.0-0 |
| - fixed: 1.21.1 |
| vulnerable_at: 1.21.0 |
| packages: |
| - package: html/template |
| symbols: |
| - escaper.escapeText |
| - tSpecialTagEnd |
| - indexTagEnd |
| derived_symbols: |
| - Template.Execute |
| - Template.ExecuteTemplate |
| summary: Improper handling of special tags within script contexts in html/template |
| description: |- |
| The html/template package does not apply the proper rules for handling |
| occurrences of "<script", "<!--", and "</script" within JS literals in <script> |
| contexts. This may cause the template parser to improperly consider script |
| contexts to be terminated early, causing actions to be improperly escaped. This |
| could be leveraged to perform an XSS attack. |
| credits: |
| - Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) |
| references: |
| - report: https://go.dev/issue/62197 |
| - fix: https://go.dev/cl/526157 |
| - web: https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ |
| cve_metadata: |
| id: CVE-2023-39319 |
| cwe: 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' |
| references: |
| - https://security.netapp.com/advisory/ntap-20231020-0009/ |
| - https://security.gentoo.org/glsa/202311-09 |
| review_status: REVIEWED |
