CVE-2018-17142: Null Pointer Dereference
Published Sep 17, 2018
·Updated
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call
Affected Software
4 affected componentsFixes available
go/golang.org/x/net<0.0.0-20180925071336-cf3bd585ca2a
0.0.0-20180925071336-cf3bd585ca2a
Golang Net<=2018-09-17
Fedoraproject Fedora=28
Fedoraproject Fedora=29
Event History
Sep 17, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:19 AM
Frequently Asked Questions
1
What is the severity of CVE-2018-17142?
CVE-2018-17142 has a severity rating that indicates it can cause a panic and disrupt application functionality.
2
How do I fix CVE-2018-17142?
To fix CVE-2018-17142, update the Go html package to a version after 0.0.0-20180925071336-cf3bd585ca2a.
3
Which versions of Go are affected by CVE-2018-17142?
CVE-2018-17142 affects Go html package versions before 0.0.0-20180925071336-cf3bd585ca2a.
4
Is CVE-2018-17142 exploitable in production environments?
Yes, CVE-2018-17142 can be exploited in production environments leading to potential crashes.
5
What components of Go are impacted by CVE-2018-17142?
CVE-2018-17142 specifically impacts the html package in Go's x/net library.