Bug 5326 - [Anolis OS 23] Bugfix for CVE-2023-24540
Summary: [Anolis OS 23] Bugfix for CVE-2023-24540
Status: RESOLVED INVALID
Alias: None
Product: Anolis OS 23
Classification: Anolis OS
Component: BaseOS Packages (show other bugs) BaseOS Packages
Version: unspecified
Hardware: All Linux
: P3-Medium S3-normal
Target Milestone: ---
Assignee: xuchunmei
QA Contact: bolong_tbl
URL:
Whiteboard:
Keywords: CVE
Depends on:
Blocks:
 
Reported: 2023-05-29 10:41 UTC by 小龙
Modified: 2023-05-29 11:28 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description 小龙 admin 2023-05-29 10:41:43 UTC 
Description:
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Broken commit info:

Bugfix commit info:
https://github.com/golang/go/commit/a32232cb18ed07496ec77c1cf2dcefa1cb0ac057
https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797
https://github.com/golang/go/commit/4a28cad66655ee01c6e944271e23c33cab021765
Comment 1 扣肉 2023-05-29 11:28:03 UTC 
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU?pli=1

目前anolis 23中的版本是 golang-1.20.4，已经修复了 CVE-2023-24539, CVE-2023-24540, CVE-2023-29400