VDB
RHBA-2023%3A7648
RHBA-2023%3A7648
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in Golang. The html/template package did not properly handle HMTL-like "<!--" and "-->" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This issue may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | migration-toolkit-virtualization/mtv-rhv-populator-rhel8@sha256:8fedc9fe464f5cacd62bb045b248e43d3bd89cbcefd168a3a1fae01e4728bd02_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-rhv-populator-rhel8@sha256:8fedc9fe464f5cacd62bb045b248e43d3bd89cbcefd168a3a1fae01e4728bd02_amd64, migration-toolkit-virtualization/mtv-rhv-populator-rhel8@sha256:8fedc9fe464f5cacd62bb045b248e43d3bd89cbcefd168a3a1fae01e4728bd02_amd64, migration-toolkit-virtualization/mtv-rhv-populator-rhel8@sha256:8fedc9fe464f5cacd62bb045b248e43d3bd89cbcefd168a3a1fae01e4728bd02_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:fceee04ea01c3b516623ef6f15591e6807b9f00fe0c172d54b5d2787f51ac3b6_amd64 as a component of 8Base-MTV-2.5 | *, migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:fceee04ea01c3b516623ef6f15591e6807b9f00fe0c172d54b5d2787f51ac3b6_amd64, * |
| Red Hat | migration-toolkit-virtualization/mtv-operator-bundle@sha256:f6b4db29214b9e92404569b732eb4df67c3f5cab85f9f56219aee2e330a034ac_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-operator-bundle@sha256:f6b4db29214b9e92404569b732eb4df67c3f5cab85f9f56219aee2e330a034ac_amd64, migration-toolkit-virtualization/mtv-operator-bundle@sha256:f6b4db29214b9e92404569b732eb4df67c3f5cab85f9f56219aee2e330a034ac_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-validation-rhel9@sha256:e0a5ff55776d70f48cd20ee87c8ca38039a1f1325d726041e958cf47f97711fe_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-validation-rhel9@sha256:e0a5ff55776d70f48cd20ee87c8ca38039a1f1325d726041e958cf47f97711fe_amd64, migration-toolkit-virtualization/mtv-validation-rhel9@sha256:e0a5ff55776d70f48cd20ee87c8ca38039a1f1325d726041e958cf47f97711fe_amd64, migration-toolkit-virtualization/mtv-validation-rhel9@sha256:e0a5ff55776d70f48cd20ee87c8ca38039a1f1325d726041e958cf47f97711fe_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:d478f7b0cafe869f013da6ddc58055e8a54fa6f7e0778cd05176f08ca4cc4e5f_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:d478f7b0cafe869f013da6ddc58055e8a54fa6f7e0778cd05176f08ca4cc4e5f_amd64, migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:d478f7b0cafe869f013da6ddc58055e8a54fa6f7e0778cd05176f08ca4cc4e5f_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:8754f24846c622dab9bd423895512a8380f5bdb11569632a5ef8330f2beca1d7_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:8754f24846c622dab9bd423895512a8380f5bdb11569632a5ef8330f2beca1d7_amd64, migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:8754f24846c622dab9bd423895512a8380f5bdb11569632a5ef8330f2beca1d7_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-rhel8-operator@sha256:97e9e4096fe23ef06a79cc24db15f2d185922a76c00bf96fd4b49d541186c8fe_amd64 as a component of 8Base-MTV-2.5 | *, migration-toolkit-virtualization/mtv-rhel8-operator@sha256:97e9e4096fe23ef06a79cc24db15f2d185922a76c00bf96fd4b49d541186c8fe_amd64, migration-toolkit-virtualization/mtv-rhel8-operator@sha256:97e9e4096fe23ef06a79cc24db15f2d185922a76c00bf96fd4b49d541186c8fe_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-validation-rhel9@sha256:e0a5ff55776d70f48cd20ee87c8ca38039a1f1325d726041e958cf47f97711fe_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-validation-rhel9@sha256:e0a5ff55776d70f48cd20ee87c8ca38039a1f1325d726041e958cf47f97711fe_amd64, migration-toolkit-virtualization/mtv-validation-rhel9@sha256:e0a5ff55776d70f48cd20ee87c8ca38039a1f1325d726041e958cf47f97711fe_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-operator-bundle@sha256:f6b4db29214b9e92404569b732eb4df67c3f5cab85f9f56219aee2e330a034ac_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-operator-bundle@sha256:f6b4db29214b9e92404569b732eb4df67c3f5cab85f9f56219aee2e330a034ac_amd64, migration-toolkit-virtualization/mtv-operator-bundle@sha256:f6b4db29214b9e92404569b732eb4df67c3f5cab85f9f56219aee2e330a034ac_amd64, migration-toolkit-virtualization/mtv-operator-bundle@sha256:f6b4db29214b9e92404569b732eb4df67c3f5cab85f9f56219aee2e330a034ac_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-virt-v2v-warm-rhel8@sha256:cce69df41be6386f1abf91f6466a4d8deaab4ec893354bd9e8be90fc35ef46b1_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-virt-v2v-warm-rhel8@sha256:cce69df41be6386f1abf91f6466a4d8deaab4ec893354bd9e8be90fc35ef46b1_amd64, migration-toolkit-virtualization/mtv-virt-v2v-warm-rhel8@sha256:cce69df41be6386f1abf91f6466a4d8deaab4ec893354bd9e8be90fc35ef46b1_amd64, migration-toolkit-virtualization/mtv-virt-v2v-warm-rhel8@sha256:cce69df41be6386f1abf91f6466a4d8deaab4ec893354bd9e8be90fc35ef46b1_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:20ba9c9859980fecdcf6aab2c9b90808fe2170e2e6408eab680721341816b316_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:20ba9c9859980fecdcf6aab2c9b90808fe2170e2e6408eab680721341816b316_amd64, *, migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:20ba9c9859980fecdcf6aab2c9b90808fe2170e2e6408eab680721341816b316_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-rhv-populator-rhel8@sha256:8fedc9fe464f5cacd62bb045b248e43d3bd89cbcefd168a3a1fae01e4728bd02_amd64 as a component of 8Base-MTV-2.5 | *, * |
| Red Hat | migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0df281d03f068951d4f82683bd1c3348ac905dd7d7097adb82ebd32da09e3159_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0df281d03f068951d4f82683bd1c3348ac905dd7d7097adb82ebd32da09e3159_amd64, migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0df281d03f068951d4f82683bd1c3348ac905dd7d7097adb82ebd32da09e3159_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-api-rhel9@sha256:886beb6c16e2c325aad2c0aa7ab33d261af0c59daf901f1325a4f855a93e94e3_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-api-rhel9@sha256:886beb6c16e2c325aad2c0aa7ab33d261af0c59daf901f1325a4f855a93e94e3_amd64, migration-toolkit-virtualization/mtv-api-rhel9@sha256:886beb6c16e2c325aad2c0aa7ab33d261af0c59daf901f1325a4f855a93e94e3_amd64, migration-toolkit-virtualization/mtv-api-rhel9@sha256:886beb6c16e2c325aad2c0aa7ab33d261af0c59daf901f1325a4f855a93e94e3_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:d0b218a09f5435fee89a2b0a9f4ff9a56891b123e565611094ebc81927576f92_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:d0b218a09f5435fee89a2b0a9f4ff9a56891b123e565611094ebc81927576f92_amd64, migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:d0b218a09f5435fee89a2b0a9f4ff9a56891b123e565611094ebc81927576f92_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-rhel8-operator@sha256:97e9e4096fe23ef06a79cc24db15f2d185922a76c00bf96fd4b49d541186c8fe_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-rhel8-operator@sha256:97e9e4096fe23ef06a79cc24db15f2d185922a76c00bf96fd4b49d541186c8fe_amd64, * |
| Red Hat | migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:d478f7b0cafe869f013da6ddc58055e8a54fa6f7e0778cd05176f08ca4cc4e5f_amd64 as a component of 8Base-MTV-2.5 | *, migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:d478f7b0cafe869f013da6ddc58055e8a54fa6f7e0778cd05176f08ca4cc4e5f_amd64, migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:d478f7b0cafe869f013da6ddc58055e8a54fa6f7e0778cd05176f08ca4cc4e5f_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:8754f24846c622dab9bd423895512a8380f5bdb11569632a5ef8330f2beca1d7_amd64 as a component of 8Base-MTV-2.5 | *, *, migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:8754f24846c622dab9bd423895512a8380f5bdb11569632a5ef8330f2beca1d7_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-api-rhel9@sha256:886beb6c16e2c325aad2c0aa7ab33d261af0c59daf901f1325a4f855a93e94e3_amd64 as a component of 8Base-MTV-2.5 | migration-toolkit-virtualization/mtv-api-rhel9@sha256:886beb6c16e2c325aad2c0aa7ab33d261af0c59daf901f1325a4f855a93e94e3_amd64, migration-toolkit-virtualization/mtv-api-rhel9@sha256:886beb6c16e2c325aad2c0aa7ab33d261af0c59daf901f1325a4f855a93e94e3_amd64 |
| Red Hat | migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:fceee04ea01c3b516623ef6f15591e6807b9f00fe0c172d54b5d2787f51ac3b6_amd64 as a component of 8Base-MTV-2.5 | *, migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:fceee04ea01c3b516623ef6f15591e6807b9f00fe0c172d54b5d2787f51ac3b6_amd64 |
…and 9 more
Timeline
- Dec 5, 2023 CVE Published
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 19, 2026 CVE Updated
References
- https://go.dev/cl/523039 advisory
- https://go.dev/issue/62266 advisory
- https://access.redhat.com/errata/RHBA-2023:7648 advisory
- https://issues.redhat.com/browse/MTV-698 advisory
- https://issues.redhat.com/browse/MTV-699 advisory
- https://issues.redhat.com/browse/MTV-714 advisory
- https://issues.redhat.com/browse/MTV-783 advisory
- https://issues.redhat.com/browse/MTV-803 advisory
- https://issues.redhat.com/browse/MTV-811 advisory
- https://issues.redhat.com/browse/MTV-812 advisory
- https://issues.redhat.com/browse/MTV-818 advisory
- https://issues.redhat.com/browse/MTV-830 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_7648.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39318 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2237776 issue
- https://www.cve.org/CVERecord?id=CVE-2023-39318 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39318 advisory
- https://go.dev/cl/526156 advisory
- https://go.dev/issue/62196 advisory
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ advisory
…and 23 more