CVE-2023-29400

2023-05-1116:15:09

Alpine Linux Development Team

security.alpinelinux.org

html normalization injection

unquoted attributes

unexpected output

arbitrary injection

action execution

empty input

templates

security vulnerability

html parsing

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.8%

JSON

Templates containing actions in unquoted HTML attributes (e.g. “attr={{.}}”) executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchgo< 1.20.4-r0UNKNOWN
Alpine3.17-communitynoarchgo< 1.19.9-r0UNKNOWN
Alpine3.18-communitynoarchgo< 1.20.4-r0UNKNOWN
Alpine3.19-communitynoarchgo< 1.20.4-r0UNKNOWN
Alpine3.20-communitynoarchgo< 1.20.4-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	go	< 1.20.4-r0	UNKNOWN
Alpine	3.17-community	noarch	go	< 1.19.9-r0	UNKNOWN
Alpine	3.18-community	noarch	go	< 1.20.4-r0	UNKNOWN
Alpine	3.19-community	noarch	go	< 1.20.4-r0	UNKNOWN
Alpine	3.20-community	noarch	go	< 1.20.4-r0	UNKNOWN