CVE-2023-24540
First published: Sun May 07 2023(Updated: )
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
Credit: security@golang.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Golang Go | <1.19.9 | |
| Golang Go | >=1.20.0<1.20.4 | |
| redhat/golang | <1.19.9 | 1.19.9 |
| redhat/golang | <1.20.4 | 1.20.4 |
Remedy
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://go.dev/cl/491616
- https://go.dev/issue/59721
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
- https://pkg.go.dev/vuln/GO-2023-1752
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196629
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196630
- https://github.com/golang/go/commit/a32232cb18ed07496ec77c1cf2dcefa1cb0ac057
- https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797
- https://github.com/golang/go/commit/4a28cad66655ee01c6e944271e23c33cab021765
- https://access.redhat.com/errata/RHSA-2023:3318
- https://access.redhat.com/errata/RHSA-2023:3319
- https://access.redhat.com/errata/RHSA-2023:3323
- https://access.redhat.com/errata/RHSA-2023:3379
- https://access.redhat.com/errata/RHSA-2023:3415
- https://access.redhat.com/errata/RHSA-2023:3435
- https://access.redhat.com/errata/RHSA-2023:3445
- https://access.redhat.com/errata/RHSA-2023:3367
- https://access.redhat.com/errata/RHSA-2023:3366
- https://access.redhat.com/errata/RHSA-2023:3410
- https://access.redhat.com/errata/RHSA-2023:3409
- https://access.redhat.com/errata/RHSA-2023:3545
- https://access.redhat.com/errata/RHSA-2023:3624
- https://access.redhat.com/errata/RHSA-2023:3644
- https://access.redhat.com/errata/RHSA-2023:3612
- https://access.redhat.com/errata/RHSA-2023:3905
- https://access.redhat.com/errata/RHSA-2023:3918
- https://access.redhat.com/errata/RHSA-2023:3915
- https://access.redhat.com/errata/RHSA-2023:3911
- https://access.redhat.com/errata/RHSA-2023:3914
- https://access.redhat.com/errata/RHSA-2023:3910
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2207514
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2207509
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2207507
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2207522
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2204477
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196027#c45
- https://access.redhat.com/errata/RHSA-2023:4289
- https://access.redhat.com/errata/RHSA-2023:4420
- https://access.redhat.com/errata/RHSA-2023:4421
- https://access.redhat.com/errata/RHSA-2023:4470
- https://access.redhat.com/errata/RHSA-2023:4335
- https://access.redhat.com/errata/RHSA-2023:4627
- https://access.redhat.com/errata/RHSA-2023:4664
- https://access.redhat.com/errata/RHSA-2023:5376
- https://access.redhat.com/errata/RHSA-2023:5421
- https://access.redhat.com/errata/RHSA-2023:5442
- https://access.redhat.com/errata/RHSA-2023:5947
- https://access.redhat.com/errata/RHSA-2023:6346
- https://access.redhat.com/errata/RHSA-2023:6363
- https://access.redhat.com/errata/RHSA-2023:6402
- https://access.redhat.com/errata/RHSA-2023:6473
- https://access.redhat.com/errata/RHSA-2023:6474
- https://access.redhat.com/errata/RHSA-2023:6938
- https://access.redhat.com/errata/RHSA-2023:6939
- https://bugzilla.redhat.com/show_bug.cgi?id=2196027
Frequently Asked Questions
What is CVE-2023-24540?
CVE-2023-24540 is a vulnerability that affects JavaScript contexts with actions that may not properly sanitize templates containing whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in the Go programming language.
How severe is CVE-2023-24540?
CVE-2023-24540 has a severity rating of 9.8 (critical).
Which software packages are affected by CVE-2023-24540?
The affected software packages are golang versions up to and excluding 1.19.9 and golang versions within the range 1.20.0 to 1.20.4.
How can I fix CVE-2023-24540?
To fix CVE-2023-24540, update to golang version 1.19.9 or install a version within the range 1.20.0 to 1.20.4.
Where can I find more information about CVE-2023-24540?
You can find more information about CVE-2023-24540 in the following references: 1. [Bugzilla - CVE-2023-24540](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196629) 2. [Bugzilla - CVE-2023-24540](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196630) 3. [Golang Announce - CVE-2023-24540](https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU)
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-24540
- agent/software-canonical-lookup
- vendor/golang
- canonical/golang go
- version/golang go/1.20.0
- package-manager/redhat