PT-2018-13923 · Google · X/Net/Html
CVE-2018-17143
·
Publicado
2018-09-17
·
Atualizado
2023-09-09
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
html package (aka x/net/html) through 2018-09-17
Description
The issue arises from the mishandling of specific HTML tags, such as
<template><tBody><isindex/action=0>, which can lead to a "panic: runtime error" in the inBodyIM function within parse.go during an html.Parse call. This occurs due to the Parse function's inability to handle certain invalid inputs properly, resulting in a panic.Recommendations
For versions through 2018-09-17, consider updating to a version released after 2018-09-17 to resolve the issue. As a temporary workaround, consider adding input validation to prevent the
html.Parse function from processing malformed HTML tags that could trigger the panic.Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
X/Net/Html