Skip to content
Fencer Vulns
medium 6.1

CVE-2023-39318 json

Improper handling of HTML-like comments in script contexts in html/template

published 2023-09-07 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-39318 , EUVD-2023-43050 , GO-2023-2041

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

Patch / fix

  • bitnami golang 1.20.8, 1.21.1
  • go stdlib 1.20.8, 1.21.1
  • Go standard library html/template 1.20.8, 1.21.1
  • golang-1.17 Ubuntu 22.04 LTS 1.17.13-3ubuntu1.2
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.3
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.2
  • golang-1.20 Ubuntu 20.04 LTS 1.20.3-1ubuntu0.1~20.04.1
  • golang-1.20 Ubuntu 22.04 LTS 1.20.3-1ubuntu0.1~22.04.1
  • golang-1.18 Ubuntu Pro 16.04 LTS 1.18.1-1ubuntu1~16.04.6+esm1
  • golang-1.18 Ubuntu Pro 18.04 LTS 1.18.1-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2023-39318

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
  • runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
  • udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
  • podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
  • skopeo RHEL 8 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c

red hat advisories RHSA-2024:2988RHSA-2024:0121RHBA-2023:6928RHSA-2023:6840RHSA-2023:5009RHSA-2024:3467

  • go1.21-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.4.1-150000.1.5.1
  • go1.20-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.20.8.1-150000.1.11.1
  • go1.21 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.1-150000.1.6.1
  • go1.20 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.20.8-150000.1.23.1

suse advisories SUSE-SU-2023:4469-1SUSE-SU-2023:3840-1SUSE-SU-2023:3701-1SUSE-SU-2023:3700-1

  • go1.20 openSUSE Tumbleweed 1.20.8-1.1
  • go1.21 openSUSE Tumbleweed 1.21.1-1.1
  • go1.21 Package Hub 12 1.21.3-2.1
  • go Package Hub 12 1.21-41.1

opensuse advisories openSUSE-SU-2024:13216-1openSUSE-SU-2024:13217-1openSUSE-SU-2023:0360-1

  • toolbox AlmaLinux 9 0.0.99.5-2.el9
  • toolbox-tests AlmaLinux 9 0.0.99.5-2.el9
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.7-1.module_el8.9.0+3683+33eb0feb
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2024:2160ALSA-2024:0121ALSA-2023:7762ALSA-2023:7764ALSA-2023:7765ALSA-2023:7766

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • skopeo Rocky Linux 8 2:1.6.2-9.module+el8.9.0+1578+aa900b44
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
  • slirp4netns Rocky Linux 8 1.1.8-3.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2024:0121RLSA-2024:2988

  • go Alpine 3.18 1.20.8-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.21.1-r0

alpine advisories ALPINE-CVE-2023-39318

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.20.10-1
  • msft-golang CBL-Mariner 2.0 1.20.10-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-28694AZL-28832AZL-37386AZL-37494AZL-52735

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-39318 updated cvss 6.1

golang: html/template: improper handling of HTML-like comments within script contexts

  • Red Hat Cost Management Metrics Operator costmanagement/costmanagement-metrics-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel8 Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: no fix available
  • Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator
    affected: no fix available
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-cnf, redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf, redhat-certification-preflight
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 ignition, ignition-edge, ignition-grub, osbuild-composer, ignition-validate, osbuild-composer-core, +2 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 ignition, ignition-validate, sandboxed-containers
    affected: no fix available, no fix planned “Will not fix”
show 18 more
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/tempo-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8 Red Hat OpenShift on AWS rosa Red Hat OpenShift Virtualization 4 kubevirt, openshift-golang-builder-container Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent
    +2 more products
    Red Hat Quay 3 quay/clair-rhel8 Red Hat Satellite 6 yggdrasil-worker-forwarder
    affected: no fix available
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golang
    affected: no fix planned “Will not fix”
  • Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: no fix available
  • Red Hat LVMS 4.14 for RHEL 9 lvms4/topolvm-rhel9 v4.14.1-2, lvms4/lvms-rhel9-operator v4.14.1-3, lvms4/lvms-operator-bundle v4.14.1-4, lvms4/lvms-must-gather-rhel9 v4.14.1-3
    fixed: vendor fix RHBA-2023:6863
  • Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-api-rhel9 2.5.3-11
    fixed: vendor fix RHBA-2023:7648
  • Red Hat NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-rhel9-operator v1.4.0-51
    fixed: vendor fix RHSA-2023:5974
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.7-6
    fixed: vendor fix RHSA-2023:6115
  • Red Hat OSSO 1.2 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle v1.2-8, openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.2-13
    fixed: vendor fix RHSA-2023:6154
  • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/search-rhel8 v2.6.8-7, rhacm2/thanos-rhel8 v2.6.8-5, rhacm2/console-rhel8 v2.6.8-7, rhacm2/memcached-rhel8 v2.6.8-5, rhacm2/prometheus-rhel8 v2.6.8-5, rhacm2/search-api-rhel8 v2.6.8-4, +42 more
    fixed: vendor fix RHSA-2023:6202
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-3.module+el8.9.0+20656+56f336b9, crit 3.18-4.module+el8.9.0+20326+387084d0, criu 3.15-3.module+el8.9.0+20656+56f336b9, criu 3.18-4.module+el8.9.0+20326+387084d0, crun 1.8.7-1.module+el8.9.0+20656+56f336b9, runc 1.1.5-2.module+el8.9.0+20656+56f336b9, +67 more
    fixed: vendor fix RHSA-2024:2988
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.6.1-7.el9_3, skopeo 1.13.3-3.el9_3, buildah 1.31.3-2.el9_3, golang 1.20.10-1.el9_3, toolbox 0.0.99.5-2.el9, go-toolset 1.20.10-1.el9_3, +13 more
    fixed: vendor fix RHBA-2023:6364
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-velero-plugin-rhel8 v1.7.14-3
    fixed: vendor fix RHSA-2023:6161
  • Red Hat OpenShift Container Platform 4.14 runc 1.1.9-2.1.rhaos4.14.el8, runc 1.1.9-2.1.rhaos4.14.el9, podman 4.4.1-10.1.rhaos4.14.el8, podman 4.4.1-10.1.rhaos4.14.el9, skopeo 1.11.2-10.1.rhaos4.14.el8, skopeo 1.11.2-10.1.rhaos4.14.el9, +26 more
    fixed: vendor fix RHSA-2023:5009
  • Red Hat OpenStack Platform 16.1 etcd 3.3.23-16.el8ost
    fixed: vendor fix RHSA-2024:3467
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-16.el8ost
    fixed: vendor fix RHSA-2024:3352
  • Red Hat Service Interconnect 1 service-interconnect/skupper-router-rhel9 2.5.1-2, service-interconnect/skupper-operator-bundle 1.5.3-3, service-interconnect/skupper-config-sync-rhel9 1.5.3-1, service-interconnect/skupper-flow-collector-rhel9 1.5.3-2, service-interconnect/skupper-site-controller-rhel9 1.5.3-2, service-interconnect/skupper-controller-podman-rhel9 1.5.3-1, +1 more
    fixed: vendor fix RHSA-2024:1901
  • Red Hat RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9 v4.15.0-37
    fixed: vendor fix RHSA-2024:1383

1 more fixed, 15 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.93% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.20.8
>=1.21.0, <1.21.1
1.20.8
1.21.1
go stdlib
<1.20.8
>=1.21.0-0, <1.21.1
1.20.8
1.21.1

Affected products

  • Go standard library html/template

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.