You are here
Miscellaneous Golang Vulnerabilities
Last update on 20. September 2023 - 17:38.
This article describes the impact of some recently disclosed golang vulnerabilities related Airlock Gateway and Microgateway.
Airlock Gateway does not use Golang at all, so it is not affected.
Details CVE-2023-39318, CVE-2023-39318:
The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts.
The html/template package did not apply the proper rules for handling ocurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts.
Airlock Microgateway does not use the html/template package and is therefore not affected.
Details CVE-2023-39320:
The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module.
The go.mod toolchain directive is only used in the build process of the statsdexporter, which is trusted. Therefore Airlock Microgateway is not affected.
Details CVE-2023-39321, CVE-2023-39322:
Vulnerabilities related to the use of the QUIC protocol.
The QUIC protocol is not supported by the Golang components of Airlock Microgateway. Therefore, Airlock Microgateway is not affected.
No action required.