CVE-2023-3978: golang networking Cross-site Scripting

CVSS: 6.1v3.1MediumModified

AliasesSUSE-EL-9-CLIENT-TOOLS-2024-4019SUSE-SU-2024:4010-1SUSE-SU-2024:4011-1+360 more

Published 02-08-2023Last modified 27-09-2024

Vulnerability summary

CVE-2023-3978 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in golang networking. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.5% of scored vulnerabilities.

Overall risk

25/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.1 (NVD)

EPSS score

0.85%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 225

RHSA-2023:5009 RHSA-2023:6474 RHSA-2023:6938 RHSA-2023:6939 USN-8089-1 USN-8900-1+94 more

Showing 100 of 225. Use Open JSON for the complete list.

Timeline

02-08-2023
PublishedVulnerability first disclosed.
27-09-2024
Last modifiedVulnerability information updated.

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

CVSS metrics

7 scores · 7 sources · 1 version

v3.16.1

EPSS trend

Probability

0.85%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

0.00 pp

From 0.85% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.85%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Chainguard181 products

aactl< 0.4.12-r7
apko< 0.10.0-r6
aws-ebs-csi-driver< 1.23.1-r4
aws-efs-csi-driver< 1.7.0-r5
aws-load-balancer-controller< 2.6.1-r3

aws-load-balancer-controller-fips< 2.6.1-r2
azure-aad-pod-identity-mic< 1.8.17-r2
bank-vaults< 1.20.4-r3
bank-vaults-fips< 1.20.4-r3
bank-vaults-template-fips< 1.20.4-r3
bom< 0.6.0-r0
buildctl< 0.12.4-r4
buildkitd< 0.12.4-r4
chartmuseum< 0.16.0-r6
cluster-autoscaler-1.26< 1.26.4-r3
cluster-autoscaler-1.26-compat< 1.26.4-r3
cluster-autoscaler-1.27< 1.27.3-r5
cluster-autoscaler-1.27-compat< 1.27.3-r5
cluster-autoscaler-1.28< 1.28.0-r5
cluster-autoscaler-1.28-compat< 1.28.0-r5
cosign< 2.2.0-r5
crossplane-provider-aws< 0.42.0-r1
crossplane-provider-azure< 0.37.1-r4
cue< 0.6.0-r7
dex< 2.37.0-r7
dex-k8s-authenticator< 1.4.0-r4
dgraph< 23.1.0-r6
dive< 0.11.0-r7
dynamic-localpv-provisioner< 3.4.1-r3
dynamic-localpv-provisioner-fips< 3.5.0-r0
falcoctl< 0.6.2-r3
flux< 2.1.2-r1
flux-helm-controller< 0.36.2-r1
flux-image-automation-controller< 0.36.1-r3
flux-image-reflector-controller< 0.30.0-r4
flux-kustomize-controller< 1.1.1-r1
flux-notification-controller< 1.1.0-r4
flux-source-controller< 1.1.2-r1
frp< 0.52.2-r0
fuse-overlayfs-snapshotter< 1.0.7-r2
git-lfs< 3.4.0-r4
gitness< 3.0.0_beta2-r0
gke-gcloud-auth-plugin< 0.0.2-r6
gobuster< 3.6.0-r9
gomplate< 3.11.5-r6
grpcurl< 1.8.8-r3
haproxy-ingress< 0.14.5-r5
helm< 3.13.1-r1
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
hey< 0.1.4-r8
hugo< 0.119.0-r4
k3d< 5.6.0-r6
k3d-proxy< 5.6.0-r6
k3d-tools< 5.6.0-r6
k3s< 1.28.2-r1
k8sgpt< 0.3.18-r1
k8sgpt-operator< 0.0.21-r6
kaf< 0.2.6-r6
kiam< 4.2-r3
kots< 1.103.2-r2
kpt< 1.0.0_beta46-r0
kube-fluentd-operator< 1.17.6-r8
kube-logging-logging-operator-3.17< 3.17.11-r3
kube-logging-logging-operator-4.1< 4.1.0-r2
kube-logging-operator< 4.2.2-r5
kube-oidc-proxy< 1.0.4-r3
kube-state-metrics< 2.10.0-r4
kube-state-metrics-2.6< 2.6.0-r3
kube-state-metrics-fips< 2.10.0-r1
kubeflow< 1.10.0-r4
kubeflow-access-management< 1.10.0-r4
kubeflow-access-management-compat< 1.10.0-r4
kubeflow-access-management-fips< 1.10.0-r2
kubeflow-access-management-fips-compat< 1.10.0-r2
kubeflow-admission-webhook< 1.10.0-r4
kubeflow-admission-webhook-compat< 1.10.0-r4
kubeflow-admission-webhook-fips< 1.10.0-r2
kubeflow-admission-webhook-fips-compat< 1.10.0-r2
kubeflow-fips< 1.10.0-r2
kubeflow-katib< 0.15.0-r7
kubeflow-notebook-controller< 1.10.0-r4
kubeflow-notebook-controller-compat< 1.10.0-r4
kubeflow-notebook-controller-fips< 1.10.0-r2
kubeflow-notebook-controller-fips-compat< 1.10.0-r2
kubeflow-profile-controller< 1.10.0-r4
kubeflow-profile-controller-compat< 1.10.0-r4
kubeflow-profile-controller-fips< 1.10.0-r2
kubeflow-profile-controller-fips-compat< 1.10.0-r2
kubeflow-pvcviewer-controller< 1.10.0-r4
kubeflow-pvcviewer-controller-compat< 1.10.0-r4
kubeflow-pvcviewer-controller-fips< 1.10.0-r2
kubeflow-pvcviewer-controller-fips-compat< 1.10.0-r2
kubeflow-tensorboard-controller< 1.10.0-r4
kubeflow-tensorboard-controller-compat< 1.10.0-r4
kubeflow-tensorboard-controller-fips< 1.10.0-r2
kubeflow-tensorboard-controller-fips-compat< 1.10.0-r2
kubernetes-csi-external-provisioner< 3.6.0-r3
kubernetes-csi-external-resizer< 1.9.0-r3
kubernetes-csi-livenessprobe< 2.11.0-r3
kubernetes-csi-livenessprobe-2.10< 2.10.0-r3
kubernetes-csi-livenessprobe-fips< 2.11.0-r3
kubernetes-dashboard< 2.7.0-r9
kubernetes-dashboard-metrics-scraper< 1.0.9-r9
kubevela< 1.9.6-r4
kubewatch< 2.5.0-r7
mc< 0.20230628.215417-r7
memcached-exporter< 0.13.0-r7
metacontroller< 4.11.0-r6
metrics-server< 0.6.4-r4
metrics-server-fips< 0.6.4-r1
minio< 0.20230904.195737-r5
newrelic-infrastructure-agent< 1.47.2-r3
nfs-subdir-external-provisioner< 4.0.18-r1
nfs-subdir-external-provisioner-fips< 4.0.18-r2
node-problem-detector-0.8< 0.8.14-r5
nodetaint< 0.0.4-r6
nri-prometheus< 2.18.7-r3
oauth2-proxy< 7.5.1-r3
ollama< 0.1.4-r0
prometheus-adapter< 0.11.1-r3
prometheus-adapter-0.10< 0.10.1-r2
prometheus-adapter-fips< 0.11.1-r1
prometheus-adapter-fips-0.10< 0.10.1-r1
prometheus-alertmanager< 0.26.0-r4
prometheus-bind-exporter< 0.7.0-r6
prometheus-blackbox-exporter< 0.24.0-r4
prometheus-blackbox-exporter-iamguarded-compat< 0.24.0-r4
prometheus-elasticsearch-exporter< 1.6.0-r7
prometheus-elasticsearch-exporter-fips< 1.6.0-r1
prometheus-mongodb-exporter< 0.39.0-r4
prometheus-mongodb-exporter-fips< 0.39.0-r1
prometheus-mongodb-exporter-fips-0.37< 0.37.0-r1
prometheus-mysqld-exporter< 0.15.0-r6
prometheus-node-exporter< 1.6.1-r6
prometheus-node-exporter-1.5< 1.5.0-r3
prometheus-node-exporter-fips< 1.6.1-r1
prometheus-operator< 0.68.0-r4
prometheus-postgres-exporter< 0.14.0-r3
prometheus-postgres-exporter-0.10< 0.10.1-r6
prometheus-postgres-exporter-fips< 0.14.0-r1
prometheus-pushgateway< 1.6.2-r3
prometheus-pushgateway-fips< 1.6.2-r2
prometheus-pushgateway-fips-1.4< 1.4.3-r2
prometheus-stackdriver-exporter< 0.14.1-r8
prometheus-statsd-exporter< 0.24.0-r3
prometheus-statsd-exporter-fips< 0.24.0-r1
pulumi< 3.88.1-r1
pulumi-kubernetes-operator< 1.13.0-r4
pulumi-language-dotnet< 3.57.0-r3
pulumi-language-java< 0.9.8-r2
pulumi-language-yaml< 1.3.0-r5
rqlite< 7.21.4-r6
runc< 1.1.9-r5
secrets-store-csi-driver< 1.3.4-r6
secrets-store-csi-driver-provider-gcp< 1.3.0-r6
sigstore-scaffolding< 0.6.8-r4
skaffold< 2.8.0-r4
spark-operator< 1.1.27-r13
src< 5.3.0-r0
stakater-reloader< 1.0.43-r2
stakater-reloader-0.0.119< 0.0.119-r3
stakater-reloader-0.0.128< 0.0.128-r2
terraform< 1.5.5-r6
terraform-provider-sendgrid< 1.0.1-r1
terraform-provider-sendgrid-fips< 1.0.1-r1
thanos-operator< 0.3.7-r8
timoni< 0.14.2-r2
tkn< 0.32.0-r4
trillian< 1.5.2-r4
trust-manager< 0.6.0-r5
vault-csi-provider< 1.4.0-r9
vault-k8s< 1.2.1-r8
vertical-pod-autoscaler< 0.14.0-r5
volume-modifier-for-k8s-fips< 0.2.1-r0
wavefront-collector-for-kubernetes-1.12< 1.12.1-r3
wavefront-collector-for-kubernetes-1.13< 1.13.0-r3
weaviate< 1.21.6-r1
wireguard-go< 0.0.20230223-r7
yq< 4.35.2-r3
zot< 1.4.3-r9

Show all 181

Wolfi19 products

aactl< 0.4.12-r7
apko< 0.10.0-r6
aws-efs-csi-driver< 1.7.0-r5
aws-load-balancer-controller< 2.6.1-r3
bank-vaults< 1.20.4-r3

Show all 19

2 vendors · 200 products · Showing 200 of 359. Use Open JSON for the complete list.

References

42 links

go.dev/issue/61615ARTICLEWEBREPORTIssue TrackingPatchVendor Advisory
go.dev/cl/514896ARTICLEREPORTWEBFIXPatch
pkg.go.dev/vuln/GO-2023-1988AdvisoryREPORTWEBIssue TrackingPatchVendor Advisory
www.suse.com/support/update/announcement//suse-el-9-client-tools-2024-4019/Advisory
bugzilla.suse.com/1213933REPORT
bugzilla.suse.com/1223142REPORT
bugzilla.suse.com/1226759REPORT
bugzilla.suse.com/1227341REPORT
bugzilla.suse.com/1227578REPORT
bugzilla.suse.com/1227606REPORT

Show all 42 references

bugzilla.suse.com/1228424REPORT
bugzilla.suse.com/1228685REPORT
bugzilla.suse.com/1229108REPORT
bugzilla.suse.com/1229432REPORT
bugzilla.suse.com/1229437REPORT
bugzilla.suse.com/1229501REPORT
bugzilla.suse.com/1230136REPORT
bugzilla.suse.com/1230139REPORT
bugzilla.suse.com/1230285REPORT
bugzilla.suse.com/1230288REPORT
bugzilla.suse.com/1230745REPORT
bugzilla.suse.com/1231157REPORT
bugzilla.suse.com/1231206REPORT
www.suse.com/security/cve/CVE-2023-3978WEB
www.suse.com/support/update/announcement/2024/suse-su-20244010-1/Advisory
bugzilla.suse.com/1229260REPORT
bugzilla.suse.com/1230623REPORT
www.suse.com/support/update/announcement/2024/suse-su-20244011-1/Advisory
www.suse.com/support/update/announcement/2024/suse-su-20244019-1/Advisory
access.redhat.com/errata/RHSA-2024:0944Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2228689REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0944.jsonAdvisory
access.redhat.com/security/cve/CVE-2023-3978REPORT
www.cve.org/CVERecord?id=CVE-2023-3978AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2023-3978AdvisoryOval
ubuntu.com/security/CVE-2023-3978REPORT
ubuntu.com/security/notices/USN-8089-1Advisory
ubuntu.com/security/notices/USN-8089-2Advisory
ubuntu.com/security/notices/USN-8089-3Advisory
ubuntu.com/security/notices/USN-8900-1Advisory
security-tracker.debian.org/tracker/CVE-2023-3978Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities