[USN-6140-1] Go vulnerabilities

Severity Critical

Affected Packages 12

CVEs 8

Several security issues were fixed in Go.

It was discovered that Go did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a panic
resulting in a denial of service. This issue only affected golang-1.19 on
Ubuntu 22.10. (CVE-2022-41724, CVE-2023-24534, CVE-2023-24537)

It was discovered that Go did not properly validate the amount of memory
and disk files ReadForm can consume. An attacker could possibly use this
issue to cause a panic resulting in a denial of service. This issue only
affected golang-1.19 on Ubuntu 22.10. (CVE-2022-41725)

It was discovered that Go did not properly validate backticks (`) as
Javascript string delimiters, and did not escape them as expected. An
attacker could possibly use this issue to inject arbitrary Javascript code
into the Go template. This issue only affected golang-1.19 on Ubuntu 22.10.
(CVE-2023-24538)

It was discovered that Go did not properly validate the angle brackets in
CSS values. An attacker could possibly use this issue to inject arbitrary
CSS code. (CVE-2023-24539)

It was discovered that Go did not properly validate whitespace characters
in Javascript, and did not escape them as expected. An attacker could
possibly use this issue to inject arbitrary Javascript code into the Go
template. (CVE-2023-24540)

It was discovered that Go did not properly validate HTML attributes with
empty input. An attacker could possibly use this issue to inject arbitrary
HTML tags into the Go template. (CVE-2023-29400)

Package	Affected Version
pkg:deb/ubuntu/golang-1.20?distro=lunar	< 1.20.3-1ubuntu0.1
pkg:deb/ubuntu/golang-1.20-src?distro=lunar	< 1.20.3-1ubuntu0.1
pkg:deb/ubuntu/golang-1.20-go?distro=lunar	< 1.20.3-1ubuntu0.1
pkg:deb/ubuntu/golang-1.20-doc?distro=lunar	< 1.20.3-1ubuntu0.1
pkg:deb/ubuntu/golang-1.19?distro=lunar	< 1.19.8-1ubuntu0.1
pkg:deb/ubuntu/golang-1.19?distro=kinetic	< 1.19.2-1ubuntu1.1
pkg:deb/ubuntu/golang-1.19-src?distro=lunar	< 1.19.8-1ubuntu0.1
pkg:deb/ubuntu/golang-1.19-src?distro=kinetic	< 1.19.2-1ubuntu1.1
pkg:deb/ubuntu/golang-1.19-go?distro=lunar	< 1.19.8-1ubuntu0.1
pkg:deb/ubuntu/golang-1.19-go?distro=kinetic	< 1.19.2-1ubuntu1.1
pkg:deb/ubuntu/golang-1.19-doc?distro=lunar	< 1.19.8-1ubuntu0.1
pkg:deb/ubuntu/golang-1.19-doc?distro=kinetic	< 1.19.2-1ubuntu1.1

ID

USN-6140-1

Severity

critical

Severity from

CVE-2023-24538

URL

https://ubuntu.com/security/notices/USN-6140-1

Published

2023-06-06T06:44:58
(15 months ago)

Modified

2023-06-06T06:44:58
(15 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/golang-1.20?distro=lunar	ubuntu	golang-1.20	< 1.20.3-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.20-src?distro=lunar	ubuntu	golang-1.20-src	< 1.20.3-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.20-go?distro=lunar	ubuntu	golang-1.20-go	< 1.20.3-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.20-doc?distro=lunar	ubuntu	golang-1.20-doc	< 1.20.3-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.19?distro=lunar	ubuntu	golang-1.19	< 1.19.8-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.19?distro=kinetic	ubuntu	golang-1.19	< 1.19.2-1ubuntu1.1	kinetic
Affected	pkg:deb/ubuntu/golang-1.19-src?distro=lunar	ubuntu	golang-1.19-src	< 1.19.8-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.19-src?distro=kinetic	ubuntu	golang-1.19-src	< 1.19.2-1ubuntu1.1	kinetic
Affected	pkg:deb/ubuntu/golang-1.19-go?distro=lunar	ubuntu	golang-1.19-go	< 1.19.8-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.19-go?distro=kinetic	ubuntu	golang-1.19-go	< 1.19.2-1ubuntu1.1	kinetic
Affected	pkg:deb/ubuntu/golang-1.19-doc?distro=lunar	ubuntu	golang-1.19-doc	< 1.19.8-1ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/golang-1.19-doc?distro=kinetic	ubuntu	golang-1.19-doc	< 1.19.2-1ubuntu1.1	kinetic

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date