Skip to content
Fencer Vulns
high 7.3

CVE-2023-29400 json

Improper handling of empty HTML attributes in html/template

published 2023-05-05 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-29400 , EUVD-2023-32972 , GO-2023-1753

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Patch / fix

  • bitnami golang 1.19.9, 1.20.4
  • go stdlib 1.19.9, 1.20.4
  • Go standard library html/template 1.19.9, 1.20.4
  • crit RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • criu RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • crun RHEL 8 1.8.3-1.module+el8.9.0+19098+6e7a5e3f
  • runc RHEL 8 1:1.1.5-2.module+el8.9.0+19104+fcef53a3
  • udica RHEL 8 0.2.6-4.module+el8.9.0+19098+6e7a5e3f
  • conmon RHEL 8 2:2.1.4-2.module+el8.9.0+19098+6e7a5e3f
  • podman RHEL 8 2:4.0.2-24.module+el8.9.0+19784+443be299
  • skopeo RHEL 8 2:1.6.2-8.module+el8.9.0+19104+fcef53a3

red hat advisories RHSA-2023:6938RHSA-2023:6939RHSA-2023:3319RHSA-2023:6473RHSA-2023:6474RHSA-2023:6346

  • go1.19 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +5 more 1.19.9-150000.1.31.1
  • go1.20 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 1.20.4-150000.1.11.1

suse advisories SUSE-SU-2023:2127-1SUSE-SU-2023:2105-2SUSE-SU-2023:2105-1

  • go1.19 openSUSE Tumbleweed 1.19.9-1.1
  • go1.20 openSUSE Tumbleweed 1.20.4-1.1

opensuse advisories openSUSE-SU-2024:12907-1openSUSE-SU-2024:12908-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.3-1.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
  • conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2023:6938ALSA-2023:6939ALSA-2023:6346ALSA-2023:6363ALSA-2023:6402ALSA-2023:6473

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • crun Rocky Linux 8 1.8.3-1.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • podman Rocky Linux 8 2:4.0.2-24.module+el8.9.0+1445+07728297
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2023:6938RLSA-2023:6939

  • go Alpine 3.17 1.19.9-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.20.4-r0

alpine advisories ALPINE-CVE-2023-29400

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.20.7-1
  • msft-golang CBL-Mariner 2.0 1.20.7-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-26615AZL-26627AZL-34749AZL-37470AZL-37500

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29400 updated cvss 7.3

golang: html/template: improper handling of empty HTML attributes

  • Red Hat OpenShift Developer Tools and Services odo, helm
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: workaround, no fix planned “Will not fix”
  • Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel8 Red Hat AMQ Broker 7 ansible-automation-platform-24/controller-rhel8-operator Red Hat Application Interconnect 1.0 skupper-cli skupper-cli
    affected: workaround, no fix available
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 8 toolbox, toolbox-tests, osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 ignition, ignition-edge, ignition-grub, osbuild-composer, ignition-validate, osbuild-composer-core, +2 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Openshift Data Foundation 4 mcg Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8 Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
show 21 more
  • Red Hat OpenShift Virtualization 4 kubevirt
    affected: workaround, no fix available
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golang
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Web Terminal web-terminal-exec-container Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhel8-operator Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    under investigation
  • Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.13.3--2023-117063, container-native-virtualization/virtio-win-rhel9 v4.13.3--2023-117063, container-native-virtualization/kubemacpool-rhel9 v4.13.3--2023-117063, container-native-virtualization/multus-dynamic-networks-rhel9 v4.13.3-9, container-native-virtualization/virt-handler-rhel9 v4.13.3--2023-117063, container-native-virtualization/bridge-marker-rhel9 v4.13.3--2023-117063, +40 more
    fixed: vendor fix RHSA-2023:4664
  • Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8-operator 7.12.0-16, amq7/amq-broker-rhel8-operator-bundle 7.12.0-10
    fixed: vendor fix RHSA-2024:2944
  • Red Hat Migration Toolkit for Virtualization 2.4 migration-toolkit-virtualization/mtv-controller-rhel9 2.4.3-5
    fixed: vendor fix RHBA-2023:6109
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-hub-rhel9 6.2.0-16
    fixed: vendor fix RHSA-2023:4627
  • Red Hat NETOBSERV 1.3 for RHEL 9 network-observability/network-observability-rhel9-operator v1.3.0-53
    fixed: vendor fix RHSA-2023:3905
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.5-3
    fixed: vendor fix RHSA-2023:3918
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-30
    fixed: vendor fix RHSA-2023:4657
  • Red Hat Quay v3 quay/clair-rhel8 v3.8.11-3, quay/quay-rhel8 v3.8.11-13, quay/quay-builder-rhel8 v3.8.11-4, quay/quay-operator-rhel8 v3.8.11-3, quay/quay-operator-bundle v3.8.11-20, quay/quay-bridge-operator-rhel8 v3.8.11-3, +4 more
    fixed: vendor fix RHBA-2023:4275
  • Red Hat Ansible Automation Platform 2.3 for RHEL 8 openshift-clients 4.12.0-202307200611.p0.g49844f7.assembly.stream.el8
    fixed: vendor fix RHSA-2023:4470
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang 1.19.9-1.el7_9, go-toolset-1.19-golang-bin 1.19.9-1.el7_9, go-toolset-1.19-golang-src 1.19.9-1.el7_9, go-toolset-1.19-golang-misc 1.19.9-1.el7_9, go-toolset-1.19-golang-race 1.19.9-1.el7_9, go-toolset-1.19-golang-tests 1.19.9-1.el7_9 Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang 1.19.9-1.el7_9, go-toolset-1.19-golang-bin 1.19.9-1.el7_9, go-toolset-1.19-golang-src 1.19.9-1.el7_9, go-toolset-1.19-golang-misc 1.19.9-1.el7_9, go-toolset-1.19-golang-race 1.19.9-1.el7_9, go-toolset-1.19-golang-tests 1.19.9-1.el7_9
    fixed: vendor fix RHSA-2023:3323
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-3.module+el8.9.0+19243+df4d9ff2, crit 3.18-4.module+el8.9.0+19090+d2921118, criu 3.15-3.module+el8.9.0+19243+df4d9ff2, criu 3.18-4.module+el8.9.0+19090+d2921118, crun 1.8.3-1.module+el8.9.0+19098+6e7a5e3f, crun 1.8.7-1.module+el8.9.0+19731+94cfa27e, +68 more
    fixed: vendor fix RHSA-2023:3319
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.6.1-5.el9, skopeo 1.13.3-1.el9, buildah 1.31.3-1.el9, golang 1.19.9-2.el9_2, podman-tests 4.6.1-5.el9, toolbox 0.0.99.4-6.el9_3, +13 more
    fixed: vendor fix RHSA-2023:3318
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-velero-plugin-rhel8 v1.7.11-3
    fixed: vendor fix RHSA-2023:4293
  • Red Hat OpenShift Container Platform 4.13 cri-tools 1.26.0-3.el9, podman 4.4.1-4.1.rhaos4.13.el9, skopeo 1.11.2-1.1.rhaos4.13.el9, buildah 1.29.1-1.1.rhaos4.13.el9, podman-tests 4.4.1-4.1.rhaos4.13.el9, podman-docker 4.4.1-4.1.rhaos4.13.el9, +193 more
    fixed: vendor fix RHSA-2023:4093
  • Red Hat OpenShift Serverless 1.29 openshift-serverless-1/client-kn-rhel8 1.8.1-4, openshift-serverless-1/func-utils-rhel8 1.29.1-1, openshift-serverless-1/serving-queue-rhel8 1.8.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.8.0-4, openshift-serverless-1/kourier-control-rhel8 1.8.0-5, openshift-serverless-1/serving-webhook-rhel8 1.8.0-4, +30 more
    fixed: vendor fix RHSA-2023:4472
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-14.el8ost
    fixed: vendor fix RHSA-2023:3445
  • Red Hat Service Interconnect skupper-cli 1.4.1-2.el8 Red Hat Service Interconnect 1 skupper-cli 1.4.1-2.el9
    fixed: vendor fix RHSA-2023:4003

4 more fixed, 26 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
OSV 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.19.9
>=1.20.0, <1.20.4
1.19.9
1.20.4
go stdlib
<1.19.9
>=1.20.0-0, <1.20.4
1.19.9
1.20.4

Affected products

  • Go standard library html/template

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.