Skip to content
OpenAdvisories

Description

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Affected products

VendorProductAffectedFixed
Go standard library html/template < 1.19.9, 1.20.0-0 – < 1.20.4 1.19.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 12 golang-1.19 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 9 buildah +1 1:1.31.3-1.el9 RHSA-2023:6473
RHEL 9 containernetworking-plugins 1:1.3.0-4.el9 RHSA-2023:6402
RHEL 9 golang +6 1.19.9-2.el9_2 RHSA-2023:3318
RHEL 9 podman +5 2:4.6.1-5.el9 RHSA-2023:6474
RHEL 9 skopeo +1 2:1.13.3-1.el9 RHSA-2023:6363
RHEL 9 toolbox +1 0.0.99.4-6.el9_3 RHSA-2023:6346
RHEL 8 buildah +1 1:1.24.6-7.module+el8.9.0+19784+443be299 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 cockpit-podman 46-1.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 conmon 2:2.1.4-2.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 container-selinux 2:2.205.0-3.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 containernetworking-plugins 1:1.1.1-5.module+el8.9.0+19784+443be299 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 containers-common 2:1-38.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 crit +4 3.15-3.module+el8.9.0+19243+df4d9ff2 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 crun 1.8.3-1.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 delve 1.9.1-1.module+el8.8.0+16778+5fbb74f5 RHSA-2023:3319
RHEL 8 fuse-overlayfs 1.9-2.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 golang +7 1.19.9-1.module+el8.8.0+18857+fca43658 RHSA-2023:3319
RHEL 8 libslirp +1 4.4.0-1.module+el8.9.0+19243+df4d9ff2 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 netavark +1 2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 oci-seccomp-bpf-hook 1.2.5-2.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 podman +6 2:4.0.2-24.module+el8.9.0+19784+443be299 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 python-podman +1 4.0.0-2.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 runc 1:1.1.5-2.module+el8.9.0+19104+fcef53a3 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 skopeo +1 2:1.6.2-8.module+el8.9.0+19104+fcef53a3 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 slirp4netns 1.1.8-3.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
RHEL 8 toolbox +1 0.0.99.4-5.module+el8.9.0+19655+b08391f8 RHSA-2023:6939, RHSA-2023:6938
RHEL 8 udica 0.2.6-4.module+el8.9.0+19098+6e7a5e3f RHSA-2023:6939, RHSA-2023:6938
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Service Interconnect 1 skupper-cli 1.4.1-2.el8 RHSA-2023:4003
Red Hat Service Interconnect 1 skupper-router +3 2.4.1-2.el8 RHSA-2023:4003
Red Hat Openshift Ironic 4 openstack-ironic +5 1:21.3.1-0.20230510075528.b3c902e.el9 RHSA-2023:3366
Red Hat OpenStack 16 etcd 3.3.23-14.el8ost RHSA-2023:3445
Red Hat OpenShift 4 bpftool 7.0.0-284.16.1.el9_2 RHSA-2023:3366
Red Hat OpenShift 4 buildah +1 1:1.29.1-1.1.rhaos4.13.el9 RHSA-2023:3366
Red Hat OpenShift 4 cri-o 1.26.3-7.rhaos4.13.gitec064c9.el8 RHSA-2023:3366
Red Hat OpenShift 4 cri-tools 1.26.0-2.el9 RHSA-2023:4459, RHSA-2023:3366
Red Hat OpenShift 4 kernel-rt +21 5.14.0-284.16.1.rt14.301.el9_2 RHSA-2023:3366
Red Hat OpenShift 4 microshift +3 4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9 RHSA-2023:3540
Red Hat OpenShift 4 openshift +1 4.13.0-202305301919.p0.g0001a21.assembly.stream.el8 RHSA-2023:4093, RHSA-2023:3366
Red Hat OpenShift 4 openshift-clients +1 4.13.0-202305291355.p0.g1024efc.assembly.stream.el8 RHSA-2023:4093, RHSA-2023:3366
Red Hat OpenShift 4 perf +60 5.14.0-284.16.1.el9_2 RHSA-2023:3366
Red Hat OpenShift 4 podman +5 3:4.4.1-4.1.rhaos4.13.el9 RHSA-2023:3366
Red Hat OpenShift 4 skopeo +1 2:1.11.2-1.1.rhaos4.13.el9 RHSA-2023:3366
Red Hat Devtools 2023 go-toolset-1.19-golang +6 1.19.9-1.el7_9 RHSA-2023:3323
Red Hat Ansible Automation Platform 2 openshift-clients 4.12.0-202307200611.p0.g49844f7.assembly.stream.el8 RHSA-2023:4470

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 buildah +1 1:1.31.3-1.el9 ALSA-2023:6473
AlmaLinux 9 containernetworking-plugins 1:1.3.0-4.el9 ALSA-2023:6402
AlmaLinux 9 podman +5 2:4.6.1-5.el9 ALSA-2023:6474
AlmaLinux 9 skopeo +1 2:1.13.3-1.el9 ALSA-2023:6363
AlmaLinux 9 toolbox +1 0.0.99.4-6.el9_3 ALSA-2023:6346
AlmaLinux 8 buildah +1 1:1.24.6-7.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 cockpit-podman 46-1.module_el8.7.0+3344+5bcd850f ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 conmon 2:2.1.4-2.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 container-selinux 2:2.205.0-3.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 containernetworking-plugins 1:1.1.1-5.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 containers-common 2:1-38.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 crit +4 3.15-3.module_el8.6.0+2877+8e437bf5 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 crun 1.8.3-1.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 fuse-overlayfs 1.9-2.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 libslirp +1 4.4.0-1.module_el8.6.0+2877+8e437bf5 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 netavark +1 2:1.0.1-38.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 oci-seccomp-bpf-hook 1.2.5-2.module_el8.8.0+3468+16b86c82 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 podman +6 2:4.0.2-24.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 python3-podman 4.0.0-2.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 runc 1:1.1.5-2.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 skopeo +1 2:1.6.2-8.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 slirp4netns 1.1.8-3.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 toolbox +1 0.0.99.4-5.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938
AlmaLinux 8 udica 0.2.6-4.module_el8.9.0+3627+db8ec155 ALSA-2023:6939, ALSA-2023:6938

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 buildah 1:1.24.6-7.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 cockpit-podman 46-1.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 conmon 2:2.1.4-2.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 container-selinux 2:2.205.0-3.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 containernetworking-plugins 1:1.1.1-5.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 containers-common 2:1-38.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 criu 3.15-3.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 crun 1.8.3-1.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 fuse-overlayfs 1.9-2.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 libslirp 4.4.0-1.module+el8.9.0+1445+07728297 RLSA-2023:6939, RLSA-2023:6938
Rocky Linux 8 oci-seccomp-bpf-hook 1.2.5-2.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 podman 2:4.0.2-24.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 python-podman 4.0.0-2.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 runc 1:1.1.5-2.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 slirp4netns 1.1.8-3.module+el8.9.0+1445+07728297 RLSA-2023:6938
Rocky Linux 8 udica 0.2.6-4.module+el8.9.0+1445+07728297 RLSA-2023:6938
ReleasePackageFixed inAdvisory
SLES 15 SP4 go1.19 1.19.9-150000.1.31.1 SUSE-SU-2023:2127-1
SLES 15 SP4 go1.20 1.20.4-150000.1.11.1 SUSE-SU-2023:2105-1
SLES 15 SP3 go1.19 1.19.9-150000.1.31.1 SUSE-SU-2023:2127-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 go1.19 1.19.9-150000.1.31.1 SUSE-SU-2023:2127-1
SLE Real Time 15 SP3 go1.19 1.19.9-150000.1.31.1 SUSE-SU-2023:2127-1
SLE Real Time 15 SP3 go1.20 1.20.4-150000.1.11.1 SUSE-SU-2023:2105-2
SLE HPC 15 SP3 go1.19 1.19.9-150000.1.31.1 SUSE-SU-2023:2127-1
SUSE Enterprise Storage 7.1 go1.19 1.19.9-150000.1.31.1 SUSE-SU-2023:2127-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.19 1.19.9-1.1 openSUSE-SU-2024:12907-1
openSUSE Tumbleweed go1.20 1.20.4-1.1 openSUSE-SU-2024:12908-1
openSUSE Leap 15.4 go1.19 1.19.9-150000.1.31.1 SUSE-SU-2023:2127-1
openSUSE Leap 15.4 go1.20 1.20.4-150000.1.11.1 SUSE-SU-2023:2105-1
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.20.4-r0 —
Alpine v3.23 go 1.20.4-r0 —
Alpine v3.22 go 1.20.4-r0 —
Alpine v3.21 go 1.20.4-r0 —
Alpine v3.20 go 1.20.4-r0 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 go 1.20.4-r0 —
Alpine v3.18 go 1.20.4-r0 —
Alpine v3.17 go 1.19.9-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +7 1.19.9-1.amzn2023.0.1 ALAS2023-2023-209
Amazon Linux 2 golang +6 1.20.5-1.amzn2.0.2 ALAS2-2023-2163

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang 1.20.7-1 —
Azure Linux 2 (CBL-Mariner) golang +1 1.20.7-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 buildah +1 1:1.31.3-1.0.1.el9 ELSA-2023-6473
Oracle Linux 9 containernetworking-plugins 1:1.3.0-4.el9 ELSA-2023-6402
Oracle Linux 9 podman +5 2:4.6.1-5.0.1.el9 ELSA-2023-6474
Oracle Linux 9 skopeo +1 2:1.13.3-1.el9 ELSA-2023-6363
Oracle Linux 8 buildah +1 1:1.24.6-7.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 cockpit-podman 46-1.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 conmon 2:2.1.4-2.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 container-selinux 2:2.205.0-3.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 containernetworking-plugins 1:1.1.1-5.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 containers-common 2:1-38.0.1.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 crit +4 3.15-3.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 crun 1.8.3-1.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 fuse-overlayfs 1.9-2.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 libslirp +1 4.4.0-1.module+el8.9.0+90021+ce997450 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 netavark +1 2:1.0.1-38.0.1.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 oci-seccomp-bpf-hook 1.2.5-2.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 podman +6 2:4.0.2-24.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 python3-podman 4.0.0-2.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 runc 1:1.1.5-2.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 skopeo +1 2:1.6.2-8.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 slirp4netns 1.1.8-3.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938
Oracle Linux 8 udica 0.2.6-4.module+el8.9.0+90044+a34bc939 ELSA-2023-6939, ELSA-2023-6938

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling go-1.20 1.20.4-r0 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.19.9 · >= 1.20.0-0, < 1.20.4 1.19.9, 1.20.4 GO-2023-1753

Advisories 43

References