PT-2018-13923 · Google · X/Net/Html
CVE-2018-17143
·
Published
2018-09-17
·
Updated
2023-09-09
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
html package (aka x/net/html) through 2018-09-17
Description
The issue arises from the mishandling of specific HTML tags, such as
<template><tBody><isindex/action=0>, which can lead to a "panic: runtime error" in the inBodyIM function within parse.go during an html.Parse call. This occurs due to the Parse function's inability to handle certain invalid inputs properly, resulting in a panic.Recommendations
For versions through 2018-09-17, consider updating to a version released after 2018-09-17 to resolve the issue. As a temporary workaround, consider adding input validation to prevent the
html.Parse function from processing malformed HTML tags that could trigger the panic.Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
X/Net/Html