First published: Tue Mar 05 2024(Updated: )
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates. <a href="https://github.com/golang/go/issues/65697">https://github.com/golang/go/issues/65697</a>
Credit: security@golang.org security@golang.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/go | <1.21.8 | 1.21.8 |
redhat/go | <1.22.1 | 1.22.1 |
debian/golang-1.15 | <=1.15.15-1~deb11u4 | |
debian/golang-1.19 | <=1.19.8-2 | |
debian/golang-1.22 | 1.22.7-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.