Commits on May 3, 2023

1. [23.0] update go to go1.19.9 …

   go1.19.9 (released 2023-05-02) includes three security fixes to the html/template
   package, as well as bug fixes to the compiler, the runtime, and the crypto/tls
   and syscall packages. See the Go 1.19.9 milestone on our issue tracker for details.
   
   https://github.com/golang/go/issues?q=milestone%3AGo1.19.9+label%3ACherryPickApproved
   
   release notes: https://go.dev/doc/devel/release#go1.19.9
   full diff: golang/go@go1.19.8...go1.19.9
   
   from the announcement:
   
   > These minor releases include 3 security fixes following the security policy:
   >
   >- html/template: improper sanitization of CSS values
   >
   >   Angle brackets (`<>`) were not considered dangerous characters when inserted
   >   into CSS contexts. Templates containing multiple actions separated by a '/'
   >   character could result in unexpectedly closing the CSS context and allowing
   >   for injection of unexpected HMTL, if executed with untrusted input.
   >
   >   Thanks to Juho Nurminen of Mattermost for reporting this issue.
   >
   >   This is CVE-2023-24539 and Go issue https://go.dev/issue/59720.
   >
   > - html/template: improper handling of JavaScript whitespace
   >
   >   Not all valid JavaScript whitespace characters were considered to be
   >   whitespace. Templates containing whitespace characters outside of the character
   >   set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain
   >   actions may not be properly sanitized during execution.
   >
   >   Thanks to Juho Nurminen of Mattermost for reporting this issue.
   >
   >   This is CVE-2023-24540 and Go issue https://go.dev/issue/59721.
   >
   > - html/template: improper handling of empty HTML attributes
   >
   >   Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}")
   >   executed with empty input could result in output that would have unexpected
   >   results when parsed due to HTML normalization rules. This may allow injection
   >   of arbitrary attributes into tags.
   >
   >   Thanks to Juho Nurminen of Mattermost for reporting this issue.
   >
   >   This is CVE-2023-29400 and Go issue https://go.dev/issue/59722.
   
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   thaJeztah committed May 3, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 70dbd2c
   • Browse repository at this point

   Copy the full SHA

   70dbd2c View commit details

   Browse the repository at this point in the history