PT-2018-13922 · Google · X/Net/Html
Tr3Ee
·
Published
2018-09-17
·
Updated
2023-09-09
·
CVE-2018-17142
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
html package (aka x/net/html) through 2018-09-17
Description
The issue arises from the mishandling of specific HTML tags, such as
<math><template><mo><template>, which can cause a "panic: runtime error" in the parseCurrentToken function within parse.go during an html.Parse call. This error occurs due to the Parse function's inability to handle certain invalid inputs properly, leading to a panic.Recommendations
For versions through 2018-09-17, consider avoiding the use of the
html.Parse function with potentially malformed HTML inputs until a fix is applied. As a temporary workaround, validate and sanitize all HTML inputs before passing them to the html.Parse function to minimize the risk of encountering this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
X/Net/Html