Vulnerability Details CVE-2018-17143
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 69.4%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://github.com/golang/go/issues/27704
- https://go-review.googlesource.com/c/net/+/136575
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
- https://github.com/golang/go/issues/27704
- https://go-review.googlesource.com/c/net/+/136575
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
Products affected by CVE-2018-17143
-
cpe:2.3:a:golang:net:2018-07-02
-
cpe:2.3:a:golang:net:2018-07-06
-
cpe:2.3:a:golang:net:2018-07-09
-
cpe:2.3:a:golang:net:2018-07-10
-
cpe:2.3:a:golang:net:2018-07-12
-
cpe:2.3:a:golang:net:2018-07-13
-
cpe:2.3:a:golang:net:2018-09-11
-
cpe:2.3:a:golang:net:2018-09-17
-
cpe:2.3:o:fedoraproject:fedora:28
-
cpe:2.3:o:fedoraproject:fedora:29