- Vulnerability/
- USN-6140-1
USN-6140-1: Go vulnerabilities
First published: Tue Jun 06 2023(Updated: )
It was discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. This issue only affected golang-1.19 on Ubuntu 22.10. (CVE-2022-41724, CVE-2023-24534, CVE-2023-24537) It was discovered that Go did not properly validate the amount of memory and disk files ReadForm can consume. An attacker could possibly use this issue to cause a panic resulting in a denial of service. This issue only affected golang-1.19 on Ubuntu 22.10. (CVE-2022-41725) It was discovered that Go did not properly validate backticks (`) as Javascript string delimiters, and did not escape them as expected. An attacker could possibly use this issue to inject arbitrary Javascript code into the Go template. This issue only affected golang-1.19 on Ubuntu 22.10. (CVE-2023-24538) It was discovered that Go did not properly validate the angle brackets in CSS values. An attacker could possibly use this issue to inject arbitrary CSS code. (CVE-2023-24539) It was discovered that Go did not properly validate whitespace characters in Javascript, and did not escape them as expected. An attacker could possibly use this issue to inject arbitrary Javascript code into the Go template. (CVE-2023-24540) It was discovered that Go did not properly validate HTML attributes with empty input. An attacker could possibly use this issue to inject arbitrary HTML tags into the Go template. (CVE-2023-29400)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/golang-1.19-go | <1.19.8-1ubuntu0.1 | 1.19.8-1ubuntu0.1 |
| Ubuntu | =23.04 | |
| All of | ||
| ubuntu/golang-1.19-src | <1.19.8-1ubuntu0.1 | 1.19.8-1ubuntu0.1 |
| Ubuntu | =23.04 | |
| All of | ||
| ubuntu/golang-1.20-go | <1.20.3-1ubuntu0.1 | 1.20.3-1ubuntu0.1 |
| Ubuntu | =23.04 | |
| All of | ||
| ubuntu/golang-1.20 | <1.20.3-1ubuntu0.1 | 1.20.3-1ubuntu0.1 |
| Ubuntu | =23.04 | |
| All of | ||
| ubuntu/golang-1.19 | <1.19.8-1ubuntu0.1 | 1.19.8-1ubuntu0.1 |
| Ubuntu | =23.04 | |
| All of | ||
| ubuntu/golang-1.20-src | <1.20.3-1ubuntu0.1 | 1.20.3-1ubuntu0.1 |
| Ubuntu | =23.04 | |
| All of | ||
| ubuntu/golang-1.19-src | <1.19.2-1ubuntu1.1 | 1.19.2-1ubuntu1.1 |
| Ubuntu | =22.10 | |
| All of | ||
| ubuntu/golang-1.19-go | <1.19.2-1ubuntu1.1 | 1.19.2-1ubuntu1.1 |
| Ubuntu | =22.10 | |
| All of | ||
| ubuntu/golang-1.19 | <1.19.2-1ubuntu1.1 | 1.19.2-1ubuntu1.1 |
| Ubuntu | =22.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2023-29400
- https://ubuntu.com/security/CVE-2023-24534
- https://ubuntu.com/security/CVE-2022-41725
- https://ubuntu.com/security/CVE-2023-24539
- https://ubuntu.com/security/CVE-2023-24538
- https://ubuntu.com/security/CVE-2023-24540
- https://ubuntu.com/security/CVE-2023-24537
- https://ubuntu.com/security/CVE-2022-41724
- https://ubuntu.com/security/notices/USN-6038-1
- https://ubuntu.com/security/notices/USN-6038-2
- https://ubuntu.com/security/notices/USN-7111-1
- https://ubuntu.com/security/notices/USN-7109-1
- https://ubuntu.com/security/notices/USN-7061-1
- https://launchpad.net/ubuntu/+source/golang-1.19/1.19.8-1ubuntu0.1
- https://launchpad.net/ubuntu/+source/golang-1.20/1.20.3-1ubuntu0.1
- https://launchpad.net/ubuntu/+source/golang-1.19/1.19.2-1ubuntu1.1
- https://ubuntu.com/security/notices/USN-6140-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of USN-6140-1?
The severity of USN-6140-1 is considered high as it can lead to a denial of service due to memory management issues.
How do I fix USN-6140-1?
To fix USN-6140-1, update to the patched versions of golang-1.19-go, golang-1.19-src, golang-1.20-go, or golang-1.20 depending on your system.
Which versions are affected by USN-6140-1?
USN-6140-1 affects golang-1.19 on Ubuntu 22.10 and versions of golang-1.20 on Ubuntu 23.04.
Can my system be exploited due to USN-6140-1?
Yes, systems running affected versions of golang could potentially be exploited leading to service disruption.
What specific vulnerabilities are addressed in USN-6140-1?
USN-6140-1 addresses vulnerabilities identified by CVE-2022-41724, CVE-2023-24534, and CVE-2023-24537.
- agent/severity
- agent/last-modified-date
- agent/title
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/references
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/23.04
- version/ubuntu/22.10