Описание
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS, an attack that executes malicious scripts in a user's browser) through improper output escaping. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state. Consequently, subsequent regular expression literals are not accurately recognized and escaped, potentially allowing untrusted content to bypass template sanitization.
Отчет
A MODERATE severity cross-site scripting (XSS) vulnerability was found in Go's html/template package, which is shipped and used across multiple Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset), Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and other components that build against the Go toolchain. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state upon entering a new expression. As a result, subsequent regular expression literals are not accurately recognized and escaped, allowing a remote attacker to supply untrusted content through a template that bypasses html/template sanitization and executes malicious script in a victim's browser. Successful exploitation requires a victim user to visit a rendered page of a Go web application that interpolates attacker-controlled input into JavaScript template literals. Red Hat has rated this flaw MODERATE with a CVSS 3.1 score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), consistent with the upstream assessment; the impact is limited to low confidentiality and integrity loss within the client browser context, with no availability impact. Because the CVSS score is below 7.0, the fix is deferred for the affected Red Hat product streams and update trackers are not being filed for this MODERATE severity flaw at this time. The residual risk is limited to Go-based web applications that render attacker-controlled content through html/template into JavaScript contexts; the flaw does not affect applications that do not use html/template with JavaScript template literals.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | helm | Out of support scope | ||
| OpenShift Pipelines | openshift-pipelines-client | Fix deferred | ||
| OpenShift Serverless | kn-workflow-plugin | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-clients | Fix deferred | ||
| OpenShift Service Mesh 3 | istio-proxy | Fix deferred | ||
| OpenShift Service Mesh 3 | openshift-golang-builder-container | Affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl30 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl32 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | receptor | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Reset context tracking on consecutive template expressions in html/template
When a JavaScript template literal contains consecutive expressions, t ...
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
EPSS
6.1 Medium
CVSS3