CVE-2018-17143: Buffer Overflow
Published Sep 17, 2018
·Updated
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call
Affected Software
4 affected componentsFixes available
go/golang.org/x/net<0.0.0-20180921000356-2f5d2388922f
0.0.0-20180921000356-2f5d2388922f
Golang Net<=2018-09-17
Fedoraproject Fedora=28
Fedoraproject Fedora=29
Remediation
Patch Available
Event History
Sep 17, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:19 AM
Frequently Asked Questions
1
What is the severity of CVE-2018-17143?
CVE-2018-17143 is classified as a vulnerability that can lead to a panic error during HTML parsing.
2
How do I fix CVE-2018-17143?
To resolve CVE-2018-17143, upgrade the html package in Go to at least version 0.0.0-20180921000356-2f5d2388922f.
3
What types of applications are affected by CVE-2018-17143?
CVE-2018-17143 affects Go applications that utilize the html package for parsing HTML content.
4
Is CVE-2018-17143 present in specific Fedora versions?
Yes, CVE-2018-17143 is present in Fedora versions 28 and 29.
5
What is the primary impact of CVE-2018-17143?
The primary impact of CVE-2018-17143 is a runtime panic that can disrupt the execution of applications that improperly handle specific HTML constructs.