GO-2022-0197
Panic when parsing certain inputs in golang.org/x/net/html
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2018-17847, CVE-2018-17848
- Alias
- GHSA-4r78-hx75-jjj2, GHSA-mv93-wvcp-7m7r
Description
The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input "<svg><template><desc><t><svg></template>".
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · golang.org/x/net | introduced 0, fixed 0.0.0-20190125002852-4b62a64f59f7 |
Références
- https://go.dev/cl/159397 FIX
- https://go.googlesource.com/net/+/4b62a64f59f73840b9ab79204c94fee61cd1ba2c FIX
- https://go.dev/issue/27846 REPORT
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |