Cross-site scripting in Go programming language - CVE-2024-24785

Vulnerability identifier: #VU87200

CSH Severity: Low

CVSS v4 BT: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-24785

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in html/template when parsing errors returned from MarshalJSON methods. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Go programming language
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 12
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
AdGuard Home
IBM Concert Software
IBM Process Mining
Consul
Consul Enterprise
Red Hat OpenShift Builds
Run Once Duration Override Operator for Red Hat OpenShift
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Red Hat OpenShift distributed tracing (RHOSDT)
IBM Watson Discovery for IBM Cloud Pak for Data
Kube Descheduler Operator for Red Hat OpenShift
Red Hat Migration Toolkit for Applications
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Operations Dashboard
Nomad
Red Hat OpenShift Serverless
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Business Automation Manager Open Editions
Watson CP4D Data Stores
Storage Protect Server
Storage Protect Plus Container Agent
Storage Protect Plus Server
Business Automation Insights
golang-1.18 (Ubuntu package)
golang-1.18-go (Ubuntu package)
golang-1.18-src (Ubuntu package)
toolbox-tests
toolbox
toolbox (Red Hat package)
udica
conmon-rs (Red Hat package)
rhc-worker-script (Red Hat package)
python3-podman
python3-pypodman
podman-docker
podman-help
podman-debugsource
podman-debuginfo
podman
golang-github-prometheus-promu (Red Hat package)
butane (Red Hat package)
slirp4netns (Red Hat package)
runc (Red Hat package)
slirp4netns
runc
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
aardvark-dns
fuse-overlayfs (Red Hat package)
netavark
openshift-serverless-clients (Red Hat package)
fuse-overlayfs
crun (Red Hat package)
crun
skopeo (Red Hat package)
skopeo
skopeo-tests
golang-help
golang-devel
golang
golang-1.17-go (Ubuntu package)
golang-1.17-src (Ubuntu package)
golang-1.17 (Ubuntu package)
golang-1.21 (Ubuntu package)
golang-1.21-go (Ubuntu package)
golang-1.21-src (Ubuntu package)
delve
go1.21-doc
go1.21
go1.21-race
go-toolset
golang-tests
golang-src
golang-misc
golang-docs
golang-bin
golang (Red Hat package)
golang-shared
go1.21-openssl-race
go1.21-openssl-doc
go1.21-openssl
go1.22-race
go1.22-doc
go1.22
golang-1.22-go (Ubuntu package)
golang-1.22-src (Ubuntu package)
golang-1.22 (Ubuntu package)
dev-lang/go
go1.22-openssl-debuginfo
go1.22-openssl-race
go1.22-openssl-doc
go1.22-openssl
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
buildah
buildah-tests
containers-common (Red Hat package)
containers-common
conmon
conmon (Red Hat package)
oath-toolkit (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux
container-selinux (Red Hat package)
podman-remote
podman-gvproxy
podman-plugins
etcd
python3-criu
criu-libs
criu-devel
criu
crit
cephadm-ansible (Red Hat package)
libslirp
libslirp-devel
libslirp (Red Hat package)
podman (Red Hat package)
podman-tests
podmansh
podman-catatonit
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
openshift4-aws-iso (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
ceph (Red Hat package)
ovn24.03 (Red Hat package)
cockpit-podman
ostree (Red Hat package)
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
OpenShift Serverless Client
Red Hat OpenShift Container Platform
IBM Cloud Pak System
Red Hat Ceph Storage

Install updates from vendor's website.

Go programming language - addressed in versions 1.21.8, 1.22.1
AdGuard Home - update to 0.107.45
IBM Concert Software - update to 1.0.3
Nomad - addressed in versions 1.5.16, 1.6.9, 1.7.6
IBM Process Mining - update to 1.15.0 IF002
Consul - addressed in versions 1.16.7, 1.17.4
Consul Enterprise - update to 1.18.1
IBM Business Automation Manager Open Editions - update to 8.0.8
golang-1.18 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
toolbox-tests - update to 0.0.99.5.1-1.0.1
toolbox - update to 0.0.99.5.1-1.0.1
toolbox (Red Hat package) - addressed in versions 0.0.99.5-5.el9, 0.1.0-2.rhaos4.16.el8, 0.1.2-1.rhaos4.16.el9
udica - update to 0.2.6-21
conmon-rs (Red Hat package) - addressed in versions 0.6.3-1.rhaos4.16.el8, 0.6.3-1.rhaos4.16.el9
rhc-worker-script (Red Hat package) - update to 0.9-5.el7_9
python3-podman - update to 0.10.1-10
python3-pypodman - update to 0.10.1-10
podman-docker - addressed in versions 0.10.1-10, 3.4.4-8, 4.9.4-14
podman-help - addressed in versions 0.10.1-10, 3.4.4-8, 4.9.4-14
podman-debugsource - addressed in versions 0.10.1-10, 3.4.4-8, 4.9.4-14
podman-debuginfo - addressed in versions 0.10.1-10, 3.4.4-8, 4.9.4-14
podman - addressed in versions 0.10.1-10, 3.4.4-8, 4.9.4-14
golang-github-prometheus-promu (Red Hat package) - update to 0.15.0-15.2.gitd5383c5.el9
butane (Red Hat package) - update to 0.21.0-1.rhaos4.16.el8
Red Hat OpenShift Builds - update to 1.1.0
Run Once Duration Override Operator for Red Hat OpenShift - update to 1.1.1
slirp4netns (Red Hat package) - update to 1.1.8-2.rhaos4.16.el8
runc (Red Hat package) - addressed in versions 1.1.12-3.1.rhaos4.16.el8, 1.1.12-3.1.rhaos4.16.el9
slirp4netns - update to 1.2.3-1
runc - update to 1.2.9-3
oci-seccomp-bpf-hook - update to 1.2.10-1
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.3.0
OpenShift API for Data Protection (OADP) - update to 1.3.2
containernetworking-plugins (Red Hat package) - update to 1.4.0-2.1.rhaos4.16.el8
containernetworking-plugins - update to 1.4.0-7.0.1
Network Observability plugin for the Openshift Console - update to 1.6.0
aardvark-dns - update to 1.10.1-2.0.1
fuse-overlayfs (Red Hat package) - update to 1.10-2.rhaos4.16.el8
netavark - update to 1.10.3-1.0.1
openshift-serverless-clients (Red Hat package) - update to 1.12.0-7.el8
fuse-overlayfs - update to 1.13-1.0.1
crun (Red Hat package) - addressed in versions 1.14.3-1.rhaos4.16.el8, 1.14.3-1.rhaos4.16.el9
crun - update to 1.14.3-2
skopeo (Red Hat package) - addressed in versions 1.14.4-1.rhaos4.16.el8, 1.14.4-1.rhaos4.16.el9
skopeo - update to 1.14.5-6
skopeo-tests - update to 1.14.5-6
golang-help - update to 1.15.7-39
golang-devel - update to 1.15.7-39
golang - update to 1.15.7-39
golang-1.17-go (Ubuntu package) - update to 1.17.13-3ubuntu1.2
golang-1.17-src (Ubuntu package) - update to 1.17.13-3ubuntu1.2
golang-1.17 (Ubuntu package) - update to 1.17.13-3ubuntu1.2
golang-1.21 (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-go (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-src (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
delve - update to 1.21.2-3
go1.21-doc - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21 - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21-race - update to 1.21.8-150000.1.27.1
go-toolset - update to 1.21.9-1
golang - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-tests - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-src - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-misc - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-docs - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-bin - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang (Red Hat package) - update to 1.21.9-2.el9_4
golang-shared - update to 1.21.10-2
go1.21-openssl-race - update to 1.21.13.1-150600.16.3.1
go1.21-openssl-doc - update to 1.21.13.1-150600.16.3.1
go1.21-openssl - update to 1.21.13.1-150600.16.3.1
go1.22-race - update to 1.22.1-150000.1.9.1
go1.22-doc - update to 1.22.1-150000.1.9.1
go1.22 - update to 1.22.1-150000.1.9.1
golang-1.22-go (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22-src (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22 (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
dev-lang/go - update to 1.22.3
golang - update to 1.22.3-1
go1.22-openssl-debuginfo - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-race - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-doc - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
cri-tools (Red Hat package) - addressed in versions 1.29.0-3.1.el8, 1.29.0-3.1.el9
cri-o (Red Hat package) - addressed in versions 1.29.5-5.rhaos4.16.git7032128.el8, 1.29.5-5.rhaos4.16.git7032128.el9
OpenShift Serverless Client - update to 1.33.0
Red Hat OpenShift Serverless - update to 1.33.0
buildah (Red Hat package) - addressed in versions 1.33.7-1.1.rhaos4.16.el8, 1.33.7-1.1.rhaos4.16.el9
buildah - update to 1.33.14-2
buildah-tests - update to 1.33.14-2
containers-common (Red Hat package) - addressed in versions 1-77.rhaos4.16.el8, 1-77.rhaos4.16.el9
containers-common - update to 1-82.0.1
conmon - update to 2.1.10-1
conmon (Red Hat package) - addressed in versions 2.1.10-2.1.rhaos4.16.el8, 2.1.10-2.1.rhaos4.16.el9
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
oath-toolkit (Red Hat package) - update to 2.6.12-1.el9cp
haproxy (Red Hat package) - addressed in versions 2.6.13-3.rhaos4.16.el8, 2.8.5-2.rhaos4.16.el9
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-394
ignition (Red Hat package) - update to 2.18.0-2.1.rhaos4.16.el9
container-selinux - update to 2.229.0-2
container-selinux (Red Hat package) - addressed in versions 2.231.0-1.rhaos4.16.el8, 2.231.0-1.rhaos4.16.el9
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.0
podman-remote - addressed in versions 3.4.4-8, 4.9.4-14
podman-gvproxy - addressed in versions 3.4.4-8, 4.9.4-14
podman-plugins - addressed in versions 3.4.4-8, 4.9.4-14
etcd - addressed in versions 3.4.14-11, 3.4.14-16
python3-criu - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
cephadm-ansible (Red Hat package) - update to 4.1.4-1.el9cp
libslirp - update to 4.4.0-2
libslirp-devel - update to 4.4.0-2
libslirp (Red Hat package) - update to 4.4.0-4.rhaos4.16.el8
python3-podman - update to 4.9.0-3
podman (Red Hat package) - addressed in versions 4.9.4-5.1.rhaos4.16.el8, 4.9.4-5.1.rhaos4.16.el9
podman-tests - update to 4.9.4-14
podmansh - update to 4.9.4-14
podman-remote - update to 4.9.4-28.0.1
podman-docker - update to 4.9.4-28.0.1
podman-tests - update to 4.9.4-28.0.1
podman-plugins - update to 4.9.4-28.0.1
podman-gvproxy - update to 4.9.4-28.0.1
podman-catatonit - update to 4.9.4-28.0.1
podman - update to 4.9.4-28.0.1
Red Hat OpenShift Container Platform - addressed in versions 4.13.46, 4.14.34, 4.16.0, 4.16.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.16.0
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g26b43df.assembly.stream.el8, 4.16.0-202404181812.p0.g26b43df.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g7806532.assembly.stream.el8, 4.16.0-202404181812.p0.g7806532.assembly.stream.el9
openshift4-aws-iso (Red Hat package) - update to 4.16.0-202404181812.p0.gd2acdd5.assembly.stream.el8
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404301345.p0.g0e95532.assembly.stream.el8, 4.16.0-202404301345.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8, 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.16.0-202406052127.p0.ga245041.assembly.stream.el8, 4.16.0-202406052127.p0.ga245041.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.0.0
Kube Descheduler Operator for Red Hat OpenShift - update to 5.0.1
Watson CP4D Data Stores - update to 5.0.3
Red Hat Migration Toolkit for Applications - update to 7.0.3
Red Hat Ceph Storage - update to 8.1
Storage Protect Server - update to 8.1.23
Storage Protect Plus Container Agent - update to 10.1.12.7
Storage Protect Plus Server - update to 10.1.16.2
ceph (Red Hat package) - update to 19.2.1-222.el9cp
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003
Business Automation Insights - update to 24.0.0.0.1
ovn24.03 (Red Hat package) - update to 24.03.2-19.el9fdp
cockpit-podman - update to 84.1-1
IBM Observability with Instana - update to 279
Operations Dashboard - update to 2022.2.1-24
ostree (Red Hat package) - update to 2024.1-2.el9

• https://go.dev/issue/65697
• https://go.dev/cl/564196
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2610

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in AdGuardHome
• SUSE update for go1.21
• SUSE update for go1.22
• SUSE update for go1.21
• Multiple vulnerabilities in Nomad
• openEuler update for golang
• Multiple vulnerabilities in Consul
• Multiple vulnerabilities in HashiCorp Consul
• Red Hat Enterprise Linux 9 update for golang
• Multiple vulnerabilities in IBM Storage Protect Plus Container Agent
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.6
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in OpenShift Serverless Client 1.33
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.33
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in Run Once Duration Override Operator for Red Hat OpenShift 1.1
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift (OSSO) 1.3
• Multiple vulnerabilities in Kube Descheduler Operator for Red Hat OpenShift 5.0
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Ubuntu update for golang-1.21
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation
• Red Hat Enterprise Linux 7 update for rhc-worker-script
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Amazon Linux AMI update for golang
• Gentoo update for Go
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Storage Protect Plus Server
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in Operations Dashboard
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Red Hat OpenShift Builds 1.1
• IBM Watson CP4D Data Stores update for Golang Go
• SUSE update for go1.21-openssl
• Multiple vulnerabilities in IBM Cloud Pak System
• SUSE update for go1.22-openssl
• Multiple vulnerabilities in IBM Business Automation Insights
• SUSE update for go1.22-openssl
• Red Hat Enterprise Linux 9 update for toolbox
• Multiple vulnerabilities in IBM Concert Software
• Ubuntu update for golang-1.18
• openEuler 20.03 LTS SP4 update for podman
• openEuler 22.03 LTS SP3 update for podman
• openEuler 22.03 LTS SP4 update for podman
• openEuler 24.03 LTS update for podman
• openEuler 24.03 LTS SP1 update for podman
• Ubuntu update for golang-1.17
• Anolis OS update for go-toolset:an8 module
• Anolis OS update for golang
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• openEuler 24.03 LTS update for etcd
• openEuler 20.03 LTS SP4 update for etcd
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Anolis OS update for container-tools:an8 module
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0
• Multiple vulnerabilities in Red Hat OpenShift distributed tracing (RHOSDT) 3.2