Skip to content
Fencer Vulns
medium 6.1

CVE-2023-3978 json

Improper rendering of text nodes in golang.org/x/net/html

published 2023-08-02 3 y ago modified 2026-09-10 1 mo ago also GHSA-2wrh-6pvc-2jm9 , GO-2023-1988 , EUVD-2023-2188

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Patch / fix

  • go golang.org/x/net 0.13.0
  • golang.org/x/net golang.org/x/net/html 0.13.0
  • golang-golang-x-net Debian 14, Debian 13 1:0.14.0-1

debian advisories DEBIAN-CVE-2023-3978

  • golang-golang-x-net Ubuntu 22.04 LTS 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
  • lxd Ubuntu Pro 16.04 LTS 2.0.11-0ubuntu1~16.04.4+esm2
  • lxd Ubuntu Pro 18.04 LTS 3.0.3-0ubuntu1~18.04.2+esm2
  • adsys Ubuntu Pro 20.04 LTS 0.9.2~20.04.2ubuntu0.1+esm1
  • juju-core Ubuntu Pro 16.04 LTS 2.3.7-0ubuntu0.16.04.1+esm2
  • golang-golang-x-net Ubuntu Pro 22.04 LTS 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2
  • golang-golang-x-net-dev Ubuntu Pro 16.04 LTS 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
  • golang-golang-x-net-dev Ubuntu Pro 18.04 LTS 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2023-3978

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • criu RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • crun RHEL 8 1.8.3-1.module+el8.9.0+19098+6e7a5e3f
  • runc RHEL 8 1:1.1.5-2.module+el8.9.0+19104+fcef53a3
  • udica RHEL 8 0.2.6-4.module+el8.9.0+19098+6e7a5e3f
  • conmon RHEL 8 2:2.1.4-2.module+el8.9.0+19098+6e7a5e3f
  • podman RHEL 8 2:4.0.2-24.module+el8.9.0+19784+443be299
  • skopeo RHEL 8 2:1.6.2-8.module+el8.9.0+19104+fcef53a3

red hat advisories RHSA-2023:6938RHSA-2023:6939RHSA-2023:5009RHSA-2023:6474RHSA-2024:0944

  • spacecmd Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:ManagerTools:Update 5.0.10-1.41.1
  • uyuni-tools Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:ManagerTools:Update 0.1.23-1.11.1
  • scap-security-guide Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:ManagerTools:Update 0.1.74-1.29.1
  • golang-github-lusitaniae-apache_exporter Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:ManagerTools:Update 1.0.8-1.14.1
  • golang EL-9:Update:Products:ManagerTools:Update 1.20.12-1.3.1
  • wire openSUSE Leap 15.6, openSUSE Leap 15.5 0.6.0-150000.1.17.4
  • spacecmd openSUSE Leap 15.6, openSUSE Leap 15.5, Manager Client Tools 15 5.0.10-150000.3.127.3
  • mgr-daemon Manager Client Tools 15 4.3.11-150000.1.53.5

suse advisories SUSE-EL-9-CLIENT-TOOLS-2024-4019SUSE-SU-2024:4019-1SUSE-SU-2024:4011-1SUSE-SU-2024:4010-1

  • golang-github-lusitaniae-apache_exporter openSUSE Tumbleweed 1.0.8-1.1

opensuse advisories openSUSE-SU-2024:14218-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.3-1.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
  • conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2023:6938ALSA-2023:6939ALSA-2023:6474

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • crun Rocky Linux 8 1.8.3-1.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • podman Rocky Linux 8 2:4.0.2-24.module+el8.9.0+1445+07728297
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2023:6938RLSA-2023:6939

  • cert-manager CBL-Mariner 2.0 1.11.2-14
  • kubevirt CBL-Mariner 2.0 0.59.0-24
  • vitess CBL-Mariner 2.0 17.0.7-1
  • telegraf CBL-Mariner 2.0 1.27.4-1
  • cni-plugins CBL-Mariner 2.0 1.3.0-6
  • multus CBL-Mariner 2.0 4.0.2-5
  • packer CBL-Mariner 2.0 1.9.5-3
  • application-gateway-kubernetes-ingress Azure Linux 3.0 1.7.7-1

azure linux advisories AZL-27810AZL-27813AZL-27818AZL-27831AZL-31690AZL-31858

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3978 updated cvss 6.1

golang.org/x/net/html: Cross site scripting

  • Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8, oadp/oadp-rhel8-operator
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services odo
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9
    affected: no fix available
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-scanner-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    affected: no fix available
  • Red Hat Ansible Automation Platform 1.2 openshift-clients
    affected: no fix planned “Out of support scope”
  • Red Hat Ansible Automation Platform 2 openshift-clients
    affected: no fix available
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-cnf Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf Red Hat Enterprise Linux 7 podman
    affected: no fix planned “Out of support scope”
show 21 more
  • Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, ansible-service-broker, atomic-openshift-tests, atomic-openshift-master, +18 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift4/ose-tests, openshift-kube-apiserver, +23 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/ocs-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9, odf4/odf-rhel8-operator
    affected: no fix available
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-modelmesh-serving-controller-rhel8, rhods/odh-data-science-pipelines-operator-controller-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8, devspaces/devspaces-rhel8-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift on AWS rosa
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 kubevirt, openshift-golang-builder-container Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: no fix available
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8-operator 2.3.1-11
    fixed: vendor fix RHSA-2023:6031
  • Red Hat LVMS 4.14 for RHEL 9 lvms4/topolvm-rhel9 v4.14.1-2, lvms4/lvms-rhel9-operator v4.14.1-3, lvms4/lvms-operator-bundle v4.14.1-4, lvms4/lvms-must-gather-rhel9 v4.14.1-3
    fixed: vendor fix RHBA-2023:6863
  • Red Hat Migration Toolkit for Virtualization 2.4 migration-toolkit-virtualization/mtv-rhel8-operator 2.4.3-3
    fixed: vendor fix RHBA-2023:6109
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-3.module+el8.9.0+19243+df4d9ff2, crit 3.18-4.module+el8.9.0+19090+d2921118, criu 3.15-3.module+el8.9.0+19243+df4d9ff2, criu 3.18-4.module+el8.9.0+19090+d2921118, crun 1.8.3-1.module+el8.9.0+19098+6e7a5e3f, crun 1.8.7-1.module+el8.9.0+19731+94cfa27e, +60 more
    fixed: vendor fix RHSA-2023:6938
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.6.1-5.el9, podman-tests 4.6.1-5.el9, podman-docker 4.6.1-5.el9, podman-remote 4.6.1-5.el9, podman-gvproxy 4.6.1-5.el9, podman-plugins 4.6.1-5.el9
    fixed: vendor fix RHSA-2023:6474
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.13-4, rhmtc/openshift-velero-plugin-rhel8 v1.7.13-3, rhmtc/openshift-migration-velero-rhel8 v1.7.13-4, rhmtc/openshift-migration-openvpn-rhel8 v1.7.13-3, rhmtc/openshift-migration-registry-rhel8 v1.7.13-3, rhmtc/openshift-migration-rhel8-operator v1.7.13-6, +11 more
    fixed: vendor fix RHSA-2023:5888
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-machine-api-operator v4.12.0-202401190520.p0.g04504fb.assembly.stream
    fixed: vendor fix RHSA-2024:0485
  • Red Hat OpenShift Container Platform 4.14 podman 4.4.1-11.2.rhaos4.14.el8, podman 4.4.1-11.2.rhaos4.14.el9, podman-tests 4.4.1-11.2.rhaos4.14.el8, podman-tests 4.4.1-11.2.rhaos4.14.el9, podman-docker 4.4.1-11.2.rhaos4.14.el8, podman-docker 4.4.1-11.2.rhaos4.14.el9, +33 more
    fixed: vendor fix RHSA-2023:5009
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-cluster-api-rhel9 v4.15.0-202401261531.p0.gdb1841a.assembly.stream, openshift4/ose-machine-api-rhel9-operator v4.15.0-202402020339.p0.ge2b4537.assembly.stream, openshift4/ose-cluster-capi-rhel9-operator v4.15.0-202402020339.p0.g6a24e09.assembly.stream, openshift4/ose-sriov-network-webhook-rhel9 v4.15.0-202401261531.p0.g00e0317.assembly.stream, openshift4/ose-azure-cloud-node-manager-rhel9 v4.15.0-202401261531.p0.g5beac87.assembly.stream, openshift4/ose-machine-api-provider-aws-rhel9 v4.15.0-202401261531.p0.g0129b1e.assembly.stream, +10 more
    fixed: vendor fix RHSA-2023:7198
  • Red Hat RHODF 4.14 for RHEL 9 odf4/ocs-rhel9-operator v4.14.0-67
    fixed: vendor fix RHSA-2023:6832
  • Red Hat RHOSSM 2.4 for RHEL 8 openshift-service-mesh/istio-cni-rhel8 2.4.5-2
    fixed: vendor fix RHSA-2023:7216
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9 Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.3.1-8, cryostat-tech-preview/jfr-datasource-rhel8 2.3.1-8, cryostat-tech-preview/cryostat-reports-rhel8 2.3.1-8, cryostat-tech-preview/cryostat-operator-bundle 2.3.1-8, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 2.3.1-8 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python-pbr 5.11.1-0.1.el9, python-wrapt 1.14.1-1.el9, python3-pbr 5.11.1-0.1.el9, python3-wrapt 1.14.1-1.el9, python-fixtures 4.0.1-1.el9, python-tenacity 6.3.1-1.el9, +135 more Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/lokistack-gateway-rhel8, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/cluster-logging-rhel8-operator Red Hat Migration Toolkit for Virtualization 2.4 migration-toolkit-virtualization/mtv-ui-rhel8 2.4.3-2, migration-toolkit-virtualization/mtv-api-rhel9 2.4.3-5, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 2.4.3-4, migration-toolkit-virtualization/mtv-controller-rhel9 2.4.3-5, migration-toolkit-virtualization/mtv-operator-bundle 2.4.3-12, migration-toolkit-virtualization/mtv-validation-rhel9 2.4.3-5, +7 more Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-scanner-rhel8
    +1 more products
    Red Hat OpenShift Container Platform 4 cri-o, cri-tools, microshift, microshift-olm, microshift-sriov, microshift-multus, +26 more
    not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
go golang.org/x/net
<0.13.0
0.13.0

Affected products

  • golang.org/x/net golang.org/x/net/html

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.