PT-2023-3322 · Go+10 · Go+10

Juho Nurminen · Published 2023-04-20 · Updated 2024-12-13 · CVE-2023-29400

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Go versions (affected versions not specified)

Description The issue arises from templates containing actions in unquoted HTML attributes, such as "attr={{.}}", which can be executed with empty input, resulting in output with unexpected results when parsed due to HTML normalization rules. This may allow the injection of arbitrary attributes into tags. The vulnerability can be exploited by a remote attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

ALSA-2023:6346

ALSA-2023:6363

ALSA-2023:6402

ALSA-2023:6473

ALSA-2023:6474

ALSA-2023:6938

ALSA-2023:6939

ALT-PU-2023-1699

ALT-PU-2023-1734

ALT-PU-2023-4736

ALT-PU-2023-4785

ALT-PU-2023-5492

ALT-PU-2023-7055

AZL-26615

AZL-26627

AZL-34749

AZL-37470

AZL-37500

AZL-79022

BDU:2023-03472

BIT-GOLANG-2023-29400

CESA-2023_3319

CESA-2023_6938

CESA-2023_6939

CVE-2023-29400

GO-2023-1753

MGASA-2023-0169

OESA-2023-1294

OPENSUSE-SU-2024:12907-1

OPENSUSE-SU-2024:12908-1

RHSA-2023:3318

RHSA-2023:3319

RHSA-2023:3323

RHSA-2023:3366

RHSA-2023:3445

RHSA-2023:3540

RHSA-2023:4003

RHSA-2023:4093

RHSA-2023:4459

RHSA-2023:4470

RHSA-2023:6346

RHSA-2023:6363

RHSA-2023:6402

RHSA-2023:6473

RHSA-2023:6474

RHSA-2023:6938

RHSA-2023:6939

RHSA-2023_3318

RHSA-2023_3319

RHSA-2023_6346

RHSA-2023_6363

RHSA-2023_6402

RHSA-2023_6473

RHSA-2023_6474

RHSA-2023_6938

RHSA-2023_6939

SUSE-SU-2023:2105-1

SUSE-SU-2023:2105-2

SUSE-SU-2023:2127-1

USN-6140-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Go

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 130

• https://osv.dev/vulnerability/AZL-37500 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-6363.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-29400 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0169.html · Security Note
• https://osv.dev/vulnerability/OESA-2023-1294 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:6402 · Vendor Advisory
• https://pkg.go.dev/vuln/GO-2023-1753 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29400 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-6363.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2105-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79022 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-37470 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2127-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2105-2 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:6938 · Vendor Advisory