Most recent entries from all

ALSA-2023:6346 — Moderate: toolbox security and bug fix update

Affected: AlmaLinux:9: toolbox, AlmaLinux:9: toolbox-tests

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064) * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References se…

bdu:2023-03470

Withdrawn: BELL-CVE-2023-24539 — CVE-2023-24539 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2023-24539 — Improper sanitization of CSS values in html/template

Affected: Bitnami: golang

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

certfr-2023-avi-0500 — De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer une exécutio…

certfr-2023-avi-0500

EUVD-2026-211745

fkie_cve-2023-24539

GHSA-3q6h-q44p-xw88

gsd-2023-24539

msrc_CVE-2023-24539 — Improper sanitization of CSS values in html/template

msrc_CVE-2023-24539

OESA-2023-1294 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:22.03-LTS: golang, openEuler:22.03-LTS-SP1: golang

The Go Programming Language. Security Fix(es): Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.(CVE-2023-29400) Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.(CVE-2023-24539) Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.(CVE-2023-24540)

openSUSE-SU-2024:12907-1 — go1.19-1.19.9-1.1 on GA media

go1.19-1.19.9-1.1 on GA media

RHBA-2023:4275 — Red Hat Bug Fix Advisory: Red Hat Quay v3.8.11 bug fix release

golang: net/http: handle server errors after sending GOAWAY golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags golang: net/url: JoinPath does not strip relative path components in all circumstances golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: go/parser: Infinite loop in parsing golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang: html/template: improper handling of empty HTML attributes

SUSE-SU-2023:2105-2 — Security update for go1.20

Security update for go1.20

Withdrawn: UBUNTU-CVE-2023-24539

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: golang-1.20, Ubuntu:22.04:LTS: golang-1.20

WID-SEC-W-2023-1167 — Gitea: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein entfernter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.