CVE-2018-17075: Null Pointer Dereference
The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-17075?
CVE-2018-17075 has a severity level that indicates it leads to a panic and runtime error in Go's html package, affecting the stability of applications using this package.
How do I fix CVE-2018-17075?
To fix CVE-2018-17075, upgrade to the html package version 0.0.0-20180816102801-aaf60122140d or later.
Which software is affected by CVE-2018-17075?
CVE-2018-17075 affects the html package in Go prior to version 0.0.0-20180816102801-aaf60122140d and specific versions of Fedora 28 and 29.
What kind of error does CVE-2018-17075 produce?
CVE-2018-17075 causes a "panic: runtime error" when html.Parse is executed on certain template elements.
Is there any relevant package that resolves CVE-2018-17075?
Yes, the remedial package for CVE-2018-17075 is golang.org/x/net with a specific version that should be upgraded to resolve the issue.