Vulnerability-Lookup

RHBA-2023:6928

Vulnerability from csaf_opensuse - Published: 2023-11-14 00:00 - Updated: 2026-09-20 10:51

Summary

bugfix update for delve

Severity

Low

Notes

Title of the patch: bugfix update for delve

Description of the patch: This bugfix update provides a functional equivalent of RHBA-2023:6928. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHBA-2023:6928.

Patchnames: RHBA-2023:6928

CVE-2023-39318

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8	—	Vendor Fix

Threats

Impact moderate

CVE-2023-39319

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-39318

Threats

Impact moderate

CVE-2023-39321

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-39318

Threats

Impact important

CVE-2023-39322

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-39318

Threats

Impact important

CVE-2023-39323

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-39318

Threats

Impact important

References

17 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2023-39318/	self
https://www.suse.com/security/cve/CVE-2023-39319/	self
https://www.suse.com/security/cve/CVE-2023-39321/	self
https://www.suse.com/security/cve/CVE-2023-39322/	self
https://www.suse.com/security/cve/CVE-2023-39323/	self
https://www.suse.com/security/cve/CVE-2023-39318	external
https://bugzilla.suse.com/1215084	external
https://www.suse.com/security/cve/CVE-2023-39319	external
https://bugzilla.suse.com/1215085	external
https://www.suse.com/security/cve/CVE-2023-39321	external
https://bugzilla.suse.com/1215087	external
https://www.suse.com/security/cve/CVE-2023-39322	external
https://bugzilla.suse.com/1215087	external
https://www.suse.com/security/cve/CVE-2023-39323	external
https://bugzilla.suse.com/1215985	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "bugfix update for delve",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This bugfix update provides a functional equivalent of RHBA-2023:6928.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHBA-2023:6928.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHBA-2023:6928",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhba-2023_6928.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39318 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39318/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39319 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39319/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39321 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39321/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39322 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39322/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39323 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39323/"
      }
    ],
    "title": "bugfix update for delve",
    "tracking": {
      "current_release_date": "2026-09-20T10:51:58Z",
      "generator": {
        "date": "2023-11-14T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHBA-2023:6928",
      "initial_release_date": "2023-11-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-11-14T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T10:51:58Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch (go-toolset:rhel8)",
                  "product_id": "golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-docs@1.20.10-1.module+el8.9.0+20382+04f7fe80?arch=noarch\u0026rpmmod=go-toolset:rhel8:8000020231114151405:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch (go-toolset:rhel8)",
                  "product_id": "golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-misc@1.20.10-1.module+el8.9.0+20382+04f7fe80?arch=noarch\u0026rpmmod=go-toolset:rhel8:8000020231114151405:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch (go-toolset:rhel8)",
                  "product_id": "golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-src@1.20.10-1.module+el8.9.0+20382+04f7fe80?arch=noarch\u0026rpmmod=go-toolset:rhel8:8000020231114151405:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch (go-toolset:rhel8)",
                  "product_id": "golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-tests@1.20.10-1.module+el8.9.0+20382+04f7fe80?arch=noarch\u0026rpmmod=go-toolset:rhel8:8000020231114151405:rhel8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64 (go-toolset:rhel8)",
                  "product_id": "delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/delve@1.20.2-1.module+el8.9.0+18926+5193682d?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8000020240321210020:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64 (go-toolset:rhel8)",
                  "product_id": "go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/go-toolset@1.20.10-1.module+el8.9.0+20382+04f7fe80?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8000020231114151405:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64 (go-toolset:rhel8)",
                  "product_id": "golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang@1.20.10-1.module+el8.9.0+20382+04f7fe80?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8000020231114151405:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64 (go-toolset:rhel8)",
                  "product_id": "golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-bin@1.20.10-1.module+el8.9.0+20382+04f7fe80?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8000020231114151405:rhel8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8"
        },
        "product_reference": "delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8"
        },
        "product_reference": "go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-39318",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39318"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html/template package does not properly handle HTML-like \"\" comment tokens, nor hashbang \"#!\" comment tokens, in \u003cscript\u003e contexts. This may cause the template parser to improperly interpret the contents of \u003cscript\u003e contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39318",
          "url": "https://www.suse.com/security/cve/CVE-2023-39318"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215084 for CVE-2023-39318",
          "url": "https://bugzilla.suse.com/1215084"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-39318"
    },
    {
      "cve": "CVE-2023-39319",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39319"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html/template package does not apply the proper rules for handling occurrences of \"\u003cscript\", \"\u003c!--\", and \"\u003c/script\" within JS literals in \u003cscript\u003e contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39319",
          "url": "https://www.suse.com/security/cve/CVE-2023-39319"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215085 for CVE-2023-39319",
          "url": "https://bugzilla.suse.com/1215085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-39319"
    },
    {
      "cve": "CVE-2023-39321",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39321"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Processing an incomplete post-handshake message for a QUIC connection can cause a panic.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39321",
          "url": "https://www.suse.com/security/cve/CVE-2023-39321"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215087 for CVE-2023-39321",
          "url": "https://bugzilla.suse.com/1215087"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-39321"
    },
    {
      "cve": "CVE-2023-39322",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39322"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39322",
          "url": "https://www.suse.com/security/cve/CVE-2023-39322"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215087 for CVE-2023-39322",
          "url": "https://bugzilla.suse.com/1215087"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-39322"
    },
    {
      "cve": "CVE-2023-39323",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39323"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Line directives (\"//line\") can be used to bypass the restrictions on \"//go:cgo_\" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running \"go build\". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
          "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39323",
          "url": "https://www.suse.com/security/cve/CVE-2023-39323"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215985 for CVE-2023-39323",
          "url": "https://bugzilla.suse.com/1215985"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:delve-0:1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:go-toolset-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-bin-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.x86_64::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-docs-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-misc-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-src-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8",
            "SUSE Liberty Linux 8:golang-tests-0:1.20.10-1.module+el8.9.0+20382+04f7fe80.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-39323"
    }
  ]
}

CVE-2023-39318 (GCVE-0-2023-39318)

Vulnerability from cvelistv5 – Published: 2023-09-08 16:13 – Updated: 2025-02-13 17:02

Title

Improper handling of HTML-like comments in script contexts in html/template

Summary

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 16:02 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go Google root

References

6 references

URL	Tags
https://go.dev/issue/62196
https://go.dev/cl/526156
https://groups.google.com/g/golang-dev/c/2C5vbR-U…
https://pkg.go.dev/vuln/GO-2023-2041
https://security.netapp.com/advisory/ntap-2023102…
https://security.gentoo.org/glsa/202311-09

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.20.8 (semver) Affected: 1.21.0-0 , < 1.21.1 (semver)

Credits

Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:06.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/62196"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/526156"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2041"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231020-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39318",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T16:02:51.219482Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T16:05:10.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "isComment"
            },
            {
              "name": "escaper.escapeText"
            },
            {
              "name": "tJS"
            },
            {
              "name": "tLineCmt"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.20.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "1.21.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The html/template package does not properly handle HTML-like \"\" comment tokens, nor hashbang \"#!\" comment tokens, in \u003cscript\u003e contexts. This may cause the template parser to improperly interpret the contents of \u003cscript\u003e contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:10:02.660Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/62196"
        },
        {
          "url": "https://go.dev/cl/526156"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2041"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231020-0009/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Improper handling of HTML-like comments in script contexts in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-39318",
    "datePublished": "2023-09-08T16:13:24.063Z",
    "dateReserved": "2023-07-27T17:05:55.186Z",
    "dateUpdated": "2025-02-13T17:02:46.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-39319 (GCVE-0-2023-39319)

Vulnerability from cvelistv5 – Published: 2023-09-08 16:13 – Updated: 2025-02-13 17:02

Title

Improper handling of special tags within script contexts in html/template

Summary

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 16:02 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go Google root

References

6 references

URL	Tags
https://go.dev/issue/62197
https://go.dev/cl/526157
https://groups.google.com/g/golang-dev/c/2C5vbR-U…
https://pkg.go.dev/vuln/GO-2023-2043
https://security.netapp.com/advisory/ntap-2023102…
https://security.gentoo.org/glsa/202311-09

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.20.8 (semver) Affected: 1.21.0-0 , < 1.21.1 (semver)

Credits

Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:06.746Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/62197"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/526157"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2043"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231020-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39319",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T16:02:49.339620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T16:04:58.123Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "escaper.escapeText"
            },
            {
              "name": "tSpecialTagEnd"
            },
            {
              "name": "indexTagEnd"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.20.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "1.21.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The html/template package does not apply the proper rules for handling occurrences of \"\u003cscript\", \"\u003c!--\", and \"\u003c/script\" within JS literals in \u003cscript\u003e contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:10:06.783Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/62197"
        },
        {
          "url": "https://go.dev/cl/526157"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2043"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231020-0009/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Improper handling of special tags within script contexts in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-39319",
    "datePublished": "2023-09-08T16:13:28.663Z",
    "dateReserved": "2023-07-27T17:05:55.186Z",
    "dateUpdated": "2025-02-13T17:02:47.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-39321 (GCVE-0-2023-39321)

Vulnerability from cvelistv5 – Published: 2023-09-08 16:13 – Updated: 2025-02-13 17:02

Title

Panic when processing post-handshake message on QUIC connections in crypto/tls

Summary

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 17:23 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Go Google root

References

6 references

URL	Tags
https://go.dev/issue/62266
https://go.dev/cl/523039
https://groups.google.com/g/golang-dev/c/2C5vbR-U…
https://pkg.go.dev/vuln/GO-2023-2044
https://security.netapp.com/advisory/ntap-2023102…
https://security.gentoo.org/glsa/202311-09

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 1.21.0-0 , < 1.21.1 (semver)

Credits

Marten Seemann

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:06.893Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/62266"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/523039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2044"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231020-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T17:23:57.925389Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T17:25:25.677Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "QUICConn.HandleData"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "1.21.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Marten Seemann"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing an incomplete post-handshake message for a QUIC connection can cause a panic."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:09:32.105Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/62266"
        },
        {
          "url": "https://go.dev/cl/523039"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2044"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231020-0004/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Panic when processing post-handshake message on QUIC connections in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-39321",
    "datePublished": "2023-09-08T16:13:30.386Z",
    "dateReserved": "2023-07-27T17:05:55.187Z",
    "dateUpdated": "2025-02-13T17:02:48.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-39322 (GCVE-0-2023-39322)

Vulnerability from cvelistv5 – Published: 2023-09-08 16:13 – Updated: 2025-02-13 17:02

Title

Memory exhaustion in QUIC connection handling in crypto/tls

Summary

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 15:53 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Go Google root

References

6 references

URL	Tags
https://go.dev/issue/62266
https://go.dev/cl/523039
https://groups.google.com/g/golang-dev/c/2C5vbR-U…
https://pkg.go.dev/vuln/GO-2023-2045
https://security.netapp.com/advisory/ntap-2023102…
https://security.gentoo.org/glsa/202311-09

Impacted products

2 products

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 1.21.0-0 , < 1.21.1 (semver)
go_standard_library	crypto_tls	Affected: 1.21.0-0 , < 1.21.1 (semver) cpe:2.3:a:go_standard_library:crypto_tls::::::::

Credits

Marten Seemann

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:07.098Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/62266"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/523039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2045"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231020-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:go_standard_library:crypto_tls:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "crypto_tls",
            "vendor": "go_standard_library",
            "versions": [
              {
                "lessThan": "1.21.1",
                "status": "affected",
                "version": "1.21.0-0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39322",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T15:53:33.932737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T15:56:13.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "QUICConn.HandleData"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "1.21.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Marten Seemann"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:09:57.257Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/62266"
        },
        {
          "url": "https://go.dev/cl/523039"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2045"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231020-0004/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Memory exhaustion in QUIC connection handling in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-39322",
    "datePublished": "2023-09-08T16:13:32.795Z",
    "dateReserved": "2023-07-27T17:05:55.187Z",
    "dateUpdated": "2025-02-13T17:02:49.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-39323 (GCVE-0-2023-39323)

Vulnerability from cvelistv5 – Published: 2023-10-05 20:36 – Updated: 2025-06-12 15:15

Title

Arbitrary code execution during build via line directives in cmd/go

Summary

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-12 15:14 UTC

CWE

CWE 94: Improper Control of Generation of Code ('Code Injection')

Assigner

Go Google root

References

9 references

URL	Tags
https://go.dev/issue/63211
https://go.dev/cl/533215
https://groups.google.com/g/golang-announce/c/XBa…
https://pkg.go.dev/vuln/GO-2023-2095
https://security.netapp.com/advisory/ntap-2023102…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.gentoo.org/glsa/202311-09

Impacted products

1 product

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.20.9 (semver) Affected: 1.21.0-0 , < 1.21.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:06.899Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/63211"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/533215"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/XBa1oHDevAo"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2095"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231020-0001/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-39323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-12T15:14:25.966284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-12T15:15:12.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.20.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.21.2",
              "status": "affected",
              "version": "1.21.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Line directives (\"//line\") can be used to bypass the restrictions on \"//go:cgo_\" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running \"go build\". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:09:58.922Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/63211"
        },
        {
          "url": "https://go.dev/cl/533215"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/XBa1oHDevAo"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2095"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231020-0001/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Arbitrary code execution during build via line directives in cmd/go"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-39323",
    "datePublished": "2023-10-05T20:36:58.756Z",
    "dateReserved": "2023-07-27T17:05:55.188Z",
    "dateUpdated": "2025-06-12T15:15:12.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHBA-2023:6928

CVE-2023-39318 (GCVE-0-2023-39318)

CVE-2023-39319 (GCVE-0-2023-39319)

CVE-2023-39321 (GCVE-0-2023-39321)

CVE-2023-39322 (GCVE-0-2023-39322)

CVE-2023-39323 (GCVE-0-2023-39323)

Tags

Sightings

Nomenclature

Related by attack behaviour