Summary
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | delve | 0:1.9.1-1.module+el8.8.0+1263+19d1a562 |
| Rocky Linux · 8 | go-toolset | 0:1.19.9-1.module+el8.8.0+1298+7af20600 |
| Rocky Linux · 8 | golang | 0:1.19.9-1.module+el8.8.0+1298+7af20600 |
Vulnerabilities 1
-
Critical 9.8
Improper handling of JavaScript whitespace in html/template
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2196027