CVE-2023-24540

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

The Go Programming Language.

Security Fix(es):

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.(CVE-2023-29400)

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.(CVE-2023-24539)

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.(CVE-2023-24540)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)

• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)

• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)

• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)

• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

• containerd: Supplementary groups are not set up properly (CVE-2023-25173)

• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)

• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)

• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• containerd: Supplementary groups are not set up properly (CVE-2023-25173)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• containerd: Supplementary groups are not set up properly (CVE-2023-25173)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)
• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• containerd: Supplementary groups are not set up properly (CVE-2023-25173)
• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)
• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

• rebuild with newer golang to fix CVE-2023-24540 (sanitize templates with whitespace outside the allowed character set in JavaScript contexts)

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in unexpectedly closing the CSS context and allowing for injection of unexpected HMTL, if executed with untrusted input. (CVE-2023-24539) Not all valid JavaScript whitespace characters were considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution. (CVE-2023-24540) Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input could result in output that would have unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. (CVE-2023-29400)

These are all security issues fixed in the go1.19-1.19.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.20-1.20.4-1.1 package on the GA media of openSUSE Tumbleweed.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for go1.20 fixes the following issues:

Update to 1.20.4 (bnc#1206346):

• CVE-2023-24539: Fixed an improper sanitization of CSS values (boo#1211029).
• CVE-2023-24540: Fixed an improper handling of JavaScript whitespace (boo#1211030).
• CVE-2023-29400: Fixed an improper handling of empty HTML attributes (boo#1211031).
• runtime: automatically bump RLIMIT_NOFILE on Unix.
• crypto/subtle: xor fails when run with race+purego.
• cmd/compile: encoding/binary.PutUint16 sometimes doesn't write.
• cmd/compile: internal compiler error: cannot call SetType(go.shape.int) on v (type int).
• cmd/compile: miscompilation in star-tex.org/x/cmd/star-tex.
• net/http: FileServer no longer serves content for POST.
• crypto/tls: TLSv1.3 connection fails with invalid PSK binder.
• cmd/compile: incorrect inline function variable.
• cmd/compile: Unified IR exports table is binary unstable in presence of generics.
• go/internal/gcimporter: lookupGorootExport should use the go command from build.Default.GOROOT.

Non-security fixes:

• Reverted go1.x Suggests go1.x-race (boo#1210963).
• Re-enabled binary stripping and debuginfo (boo#1210938).

This update for go1.20 fixes the following issues:

Update to 1.20.4 (bnc#1206346):

• CVE-2023-24539: Fixed an improper sanitization of CSS values (boo#1211029).
• CVE-2023-24540: Fixed an improper handling of JavaScript whitespace (boo#1211030).
• CVE-2023-29400: Fixed an improper handling of empty HTML attributes (boo#1211031).
• runtime: automatically bump RLIMIT_NOFILE on Unix.
• crypto/subtle: xor fails when run with race+purego.
• cmd/compile: encoding/binary.PutUint16 sometimes doesn't write.
• cmd/compile: internal compiler error: cannot call SetType(go.shape.int) on v (type int).
• cmd/compile: miscompilation in star-tex.org/x/cmd/star-tex.
• net/http: FileServer no longer serves content for POST.
• crypto/tls: TLSv1.3 connection fails with invalid PSK binder.
• cmd/compile: incorrect inline function variable.
• cmd/compile: Unified IR exports table is binary unstable in presence of generics.
• go/internal/gcimporter: lookupGorootExport should use the go command from build.Default.GOROOT.

Non-security fixes:

• Reverted go1.x Suggests go1.x-race (boo#1210963).
• Re-enabled binary stripping and debuginfo (boo#1210938).