Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2023-3978: golang.org/x/net/html may show unsafe text
CVE-2023-3978 · published 3 years ago
Summary
The Go HTML handling library can output text that should be hidden, allowing malicious code to run in a web page. This affects any Go application that uses the golang.org/x/net/html package, including the Debian and Canonical packages listed. Upgrade to the latest library version or apply the provided security patch to fix the issue.
What to do
- Update golang.org x to version 0.13.0.
- Update debian golang-golang-x-net to version 1:0.14.0-1.
- Update canonical golang-golang-x-net-dev to version 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2.
- Update canonical juju-core to version 2.3.7-0ubuntu0.16.04.1+esm2.
- Update canonical lxd to version 2.0.11-0ubuntu1~16.04.4+esm2.
- Update canonical lxd to version 3.0.3-0ubuntu1~18.04.2+esm2.
- Update canonical golang-golang-x-net-dev to version 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2.
- Update canonical adsys to version 0.9.2~20.04.2ubuntu0.1+esm1.
- Update canonical golang-golang-x-net-dev to version 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2.
- Update canonical golang-golang-x-net to version 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1.
- Update canonical golang-golang-x-net to version 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2.
- Update golang networking to version 0.13.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | golang.org | x |
< 0.13.0 Fix: upgrade to 0.13.0
|
| – | golang | networking |
< 0.13.0 cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:* |
| Debian:12 | debian | golang-golang-x-net | All versions |
| Debian:13 | debian | golang-golang-x-net |
< 1:0.14.0-1 Fix: upgrade to 1:0.14.0-1
|
| Debian:14 | debian | golang-golang-x-net |
< 1:0.14.0-1 Fix: upgrade to 1:0.14.0-1
|
| Ubuntu:Pro:16.04:LTS | canonical | golang-golang-x-net-dev |
< 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2 Fix: upgrade to 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
|
| Ubuntu:Pro:18.04:LTS | canonical | golang-golang-x-net-dev |
< 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2 Fix: upgrade to 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2
|
| Ubuntu:Pro:20.04:LTS | canonical | golang-golang-x-net-dev |
< 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2 Fix: upgrade to 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2
|
| Ubuntu:Pro:22.04:LTS | canonical | golang-golang-x-net |
< 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2 Fix: upgrade to 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2
|
| Ubuntu:Pro:16.04:LTS | canonical | juju-core |
< 2.3.7-0ubuntu0.16.04.1+esm2 Fix: upgrade to 2.3.7-0ubuntu0.16.04.1+esm2
|
| Ubuntu:Pro:16.04:LTS | canonical | lxd |
< 2.0.11-0ubuntu1~16.04.4+esm2 Fix: upgrade to 2.0.11-0ubuntu1~16.04.4+esm2
|
| Ubuntu:Pro:18.04:LTS | canonical | lxd |
< 3.0.3-0ubuntu1~18.04.2+esm2 Fix: upgrade to 3.0.3-0ubuntu1~18.04.2+esm2
|
| Ubuntu:Pro:20.04:LTS | canonical | adsys |
< 0.9.2~20.04.2ubuntu0.1+esm1 Fix: upgrade to 0.9.2~20.04.2ubuntu0.1+esm1
|
| Ubuntu:22.04:LTS | canonical | golang-golang-x-net |
< 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 Fix: upgrade to 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
|
Original advisory text
Improper rendering of text nodes in golang.org/x/net/html
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
References
- https://ubuntu.com/security/notices/USN-8089-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8089-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8089-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8900-1 Vendor Advisory
- https://pkg.go.dev/vuln/GO-2023-1988 URL
- https://github.com/advisories/GHSA-2wrh-6pvc-2jm9
- https://security-tracker.debian.org/tracker/CVE-2023-3978 Vendor Advisory
- https://go.dev/cl/514896 URL
- https://go.dev/issue/61615 URL
- https://pkg.go.dev URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3978.j... Vendor Advisory
- https://ubuntu.com/security/CVE-2023-3978 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-3978 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-3978 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Aug 2023
Updated3 Nov 2026
First seen6 Mar 2026
Sources
UBUNTU-CVE-2023-3978 · OSV
GHSA-2wrh-6pvc-2jm9 · GHSA
CVE-2023-3978 · NVD
CVE-2023-3978 · OSV
DEBIAN-CVE-2023-3978 · OSV
Track software like this
Free during beta