VDB
RHSA-2023%3A6200
RHSA-2023%3A6200
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in Golang. The html/template package did not properly handle HMTL-like "<!--" and "-->" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This issue may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/assisted-installer-reporter-rhel8@sha256:73af5120518876a9eb414678c5b8dd6bfd98046ef9f5973aa2876a480508d421_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/assisted-installer-reporter-rhel8@sha256:73af5120518876a9eb414678c5b8dd6bfd98046ef9f5973aa2876a480508d421_ppc64le, multicluster-engine/assisted-installer-reporter-rhel8@sha256:73af5120518876a9eb414678c5b8dd6bfd98046ef9f5973aa2876a480508d421_ppc64le, multicluster-engine/assisted-installer-reporter-rhel8@sha256:73af5120518876a9eb414678c5b8dd6bfd98046ef9f5973aa2876a480508d421_ppc64le |
| Red Hat | multicluster-engine/discovery-rhel8@sha256:88c01435b5371f5474f354611220461af6a8bc6de4a6c20a7163effc919b5fc4_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/discovery-rhel8@sha256:88c01435b5371f5474f354611220461af6a8bc6de4a6c20a7163effc919b5fc4_arm64, multicluster-engine/discovery-rhel8@sha256:88c01435b5371f5474f354611220461af6a8bc6de4a6c20a7163effc919b5fc4_arm64, multicluster-engine/discovery-rhel8@sha256:88c01435b5371f5474f354611220461af6a8bc6de4a6c20a7163effc919b5fc4_arm64 |
| Red Hat | multicluster-engine/aws-encryption-provider-rhel8@sha256:6c1c16758e303952426bd5d434a1838270f6ebaec041e3dc769379a0d36a7115_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/aws-encryption-provider-rhel8@sha256:6c1c16758e303952426bd5d434a1838270f6ebaec041e3dc769379a0d36a7115_s390x, multicluster-engine/aws-encryption-provider-rhel8@sha256:6c1c16758e303952426bd5d434a1838270f6ebaec041e3dc769379a0d36a7115_s390x, multicluster-engine/aws-encryption-provider-rhel8@sha256:6c1c16758e303952426bd5d434a1838270f6ebaec041e3dc769379a0d36a7115_s390x |
| Red Hat | multicluster-engine/multicluster-engine-cluster-api-provider-agent-rhel8@sha256:4091ee0eb09fbb381799968fe7bb2469e7b962b7f1caa534cff3b8b11b14317d_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | *, multicluster-engine/multicluster-engine-cluster-api-provider-agent-rhel8@sha256:4091ee0eb09fbb381799968fe7bb2469e7b962b7f1caa534cff3b8b11b14317d_arm64, multicluster-engine/multicluster-engine-cluster-api-provider-agent-rhel8@sha256:4091ee0eb09fbb381799968fe7bb2469e7b962b7f1caa534cff3b8b11b14317d_arm64 |
| Red Hat | multicluster-engine/placement-rhel8@sha256:3804df1f9f330358c8a989c9a7cc93b2ebb29f93d52797047333a578c12bc5bd_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/placement-rhel8@sha256:3804df1f9f330358c8a989c9a7cc93b2ebb29f93d52797047333a578c12bc5bd_ppc64le, multicluster-engine/placement-rhel8@sha256:3804df1f9f330358c8a989c9a7cc93b2ebb29f93d52797047333a578c12bc5bd_ppc64le, * |
| Red Hat | multicluster-engine/assisted-installer-reporter-rhel8@sha256:c1ced260adffac6d22ce06cc826ba4588f0923a0167391871662415fd238b89b_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/assisted-installer-reporter-rhel8@sha256:c1ced260adffac6d22ce06cc826ba4588f0923a0167391871662415fd238b89b_arm64, multicluster-engine/assisted-installer-reporter-rhel8@sha256:c1ced260adffac6d22ce06cc826ba4588f0923a0167391871662415fd238b89b_arm64, * |
| Red Hat | multicluster-engine/hive-rhel8@sha256:9b663a05d87daefe74645bd41dff9da17324ea5beacaa4ddbef47780234ce107_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/hive-rhel8@sha256:9b663a05d87daefe74645bd41dff9da17324ea5beacaa4ddbef47780234ce107_ppc64le, multicluster-engine/hive-rhel8@sha256:9b663a05d87daefe74645bd41dff9da17324ea5beacaa4ddbef47780234ce107_ppc64le, * |
| Red Hat | multicluster-engine/cluster-api-provider-azure-rhel8@sha256:2756166537b1c7464b866f9fd403180c548529b9691d590beafe80d2039c9830_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/cluster-api-provider-azure-rhel8@sha256:2756166537b1c7464b866f9fd403180c548529b9691d590beafe80d2039c9830_arm64, *, * |
| Red Hat | multicluster-engine/hypershift-rhel8-operator@sha256:906e21636563fdb4b08a9b27f8724051dc9ff3296ead000a646a657756729c01_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/hypershift-rhel8-operator@sha256:906e21636563fdb4b08a9b27f8724051dc9ff3296ead000a646a657756729c01_amd64, *, * |
| Red Hat | multicluster-engine/registration-rhel8@sha256:c1e5401bc5ecd8b2cdf70c92d8c0e8e8d0ae0a4e6d8f1332721bc9cced3effcb_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/registration-rhel8@sha256:c1e5401bc5ecd8b2cdf70c92d8c0e8e8d0ae0a4e6d8f1332721bc9cced3effcb_amd64, multicluster-engine/registration-rhel8@sha256:c1e5401bc5ecd8b2cdf70c92d8c0e8e8d0ae0a4e6d8f1332721bc9cced3effcb_amd64, multicluster-engine/registration-rhel8@sha256:c1e5401bc5ecd8b2cdf70c92d8c0e8e8d0ae0a4e6d8f1332721bc9cced3effcb_amd64 |
| Red Hat | multicluster-engine/hive-rhel8@sha256:9b663a05d87daefe74645bd41dff9da17324ea5beacaa4ddbef47780234ce107_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/hive-rhel8@sha256:9b663a05d87daefe74645bd41dff9da17324ea5beacaa4ddbef47780234ce107_ppc64le, multicluster-engine/hive-rhel8@sha256:9b663a05d87daefe74645bd41dff9da17324ea5beacaa4ddbef47780234ce107_ppc64le, multicluster-engine/hive-rhel8@sha256:9b663a05d87daefe74645bd41dff9da17324ea5beacaa4ddbef47780234ce107_ppc64le |
| golang | go | |
| Red Hat | multicluster-engine/assisted-image-service-rhel8@sha256:3ab9697d0cac9495e52aaf5e89dae7e62817d96c79220809689bb04043a19905_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/assisted-image-service-rhel8@sha256:3ab9697d0cac9495e52aaf5e89dae7e62817d96c79220809689bb04043a19905_arm64, multicluster-engine/assisted-image-service-rhel8@sha256:3ab9697d0cac9495e52aaf5e89dae7e62817d96c79220809689bb04043a19905_arm64, multicluster-engine/assisted-image-service-rhel8@sha256:3ab9697d0cac9495e52aaf5e89dae7e62817d96c79220809689bb04043a19905_arm64 |
| Red Hat | multicluster-engine/cluster-proxy-rhel8@sha256:e42c22402d3d8e54519c941885931d9d97dfe252efae8d6f828a86a5e05f730e_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/cluster-proxy-rhel8@sha256:e42c22402d3d8e54519c941885931d9d97dfe252efae8d6f828a86a5e05f730e_arm64, multicluster-engine/cluster-proxy-rhel8@sha256:e42c22402d3d8e54519c941885931d9d97dfe252efae8d6f828a86a5e05f730e_arm64, * |
| Red Hat | multicluster-engine/apiserver-network-proxy-rhel8@sha256:0b474adf2f6795b621d70c5a345930c52c6eacd11646a9984e21176feb97c3a1_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/apiserver-network-proxy-rhel8@sha256:0b474adf2f6795b621d70c5a345930c52c6eacd11646a9984e21176feb97c3a1_amd64, multicluster-engine/apiserver-network-proxy-rhel8@sha256:0b474adf2f6795b621d70c5a345930c52c6eacd11646a9984e21176feb97c3a1_amd64, * |
| Red Hat | multicluster-engine/cluster-api-provider-kubevirt-rhel8@sha256:3565db257d58587ade8b160f75daf59a64fad2f7accbd85e5a6e9f00731a802d_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/cluster-api-provider-kubevirt-rhel8@sha256:3565db257d58587ade8b160f75daf59a64fad2f7accbd85e5a6e9f00731a802d_s390x, *, multicluster-engine/cluster-api-provider-kubevirt-rhel8@sha256:3565db257d58587ade8b160f75daf59a64fad2f7accbd85e5a6e9f00731a802d_s390x |
| Red Hat | multicluster-engine/registration-operator-rhel8@sha256:42fbc7d17ba6a719c0590200378b1462dba715cfafe2091200990a746c966d72_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/registration-operator-rhel8@sha256:42fbc7d17ba6a719c0590200378b1462dba715cfafe2091200990a746c966d72_arm64, multicluster-engine/registration-operator-rhel8@sha256:42fbc7d17ba6a719c0590200378b1462dba715cfafe2091200990a746c966d72_arm64, * |
| Red Hat | multicluster-engine/console-mce-rhel8@sha256:ffebafa92bc54bdcdda7bfffae465c47802be7f2a28c804f28e380952c25d60a_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | *, multicluster-engine/console-mce-rhel8@sha256:ffebafa92bc54bdcdda7bfffae465c47802be7f2a28c804f28e380952c25d60a_s390x, multicluster-engine/console-mce-rhel8@sha256:ffebafa92bc54bdcdda7bfffae465c47802be7f2a28c804f28e380952c25d60a_s390x |
| Red Hat | multicluster-engine/cluster-curator-controller-rhel8@sha256:a8bca98e6f14bd8b01e52250355f2d91bbb2d0806988ddb2ddbb114d440a4c2a_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/cluster-curator-controller-rhel8@sha256:a8bca98e6f14bd8b01e52250355f2d91bbb2d0806988ddb2ddbb114d440a4c2a_ppc64le, *, * |
| Red Hat | multicluster-engine/multicloud-manager-rhel8@sha256:f09a9243dc44b3149e8f8744cbb1db47e7914630efb8684b0c86d6fc2c8d7edc_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/multicloud-manager-rhel8@sha256:f09a9243dc44b3149e8f8744cbb1db47e7914630efb8684b0c86d6fc2c8d7edc_s390x, multicluster-engine/multicloud-manager-rhel8@sha256:f09a9243dc44b3149e8f8744cbb1db47e7914630efb8684b0c86d6fc2c8d7edc_s390x, multicluster-engine/multicloud-manager-rhel8@sha256:f09a9243dc44b3149e8f8744cbb1db47e7914630efb8684b0c86d6fc2c8d7edc_s390x |
…and 285 more
Timeline
- Oct 30, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:6200 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2237773 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2237776 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2237777 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2237778 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6200.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39318 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39318 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39318 advisory
- https://go.dev/cl/526156 advisory
- https://go.dev/issue/62196 advisory
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ advisory
- https://vuln.go.dev/ID/GO-2023-2041.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39319 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39319 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39319 advisory
…and 25 more