{"id":"CVE-2018-17846","published":"2018-10-01T08:00:00Z","modified":"2024-08-05T10:54:10Z","title":"The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>…","vendor":null,"product":null,"tier":"tail","description":{"text":"The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02515,"percentile":0.8475,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/golang/go/issues/27842","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":16.9,"factors":[{"name":"EPSS percentile","points":16.95}]},"affected":[{"ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.0.0-20190125091013-d26f9f9a57f3"],"patched":["0.0.0-20190125091013-d26f9f9a57f3"],"from":["GHSA-vfw5-hrgq-h5wf","GO-2020-0014"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2602","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-17142","published":"2018-09-17","fixed":"0.0.0-20180925071336-cf3bd585ca2a","kev":false},{"cve":"CVE-2018-17847","published":"2018-10-01","fixed":"0.0.0-20190125002852-4b62a64f59f7","kev":false},{"cve":"CVE-2018-17848","published":"2018-10-01","fixed":"0.0.0-20190125002852-4b62a64f59f7","kev":false,"link":{"from":"CVE-2018-17848","to":"CVE-2018-17846","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20190125002852-4b62a64f59f7","toFixed":"0.0.0-20190125091013-d26f9f9a57f3","daysApart":0}]}},{"cve":"CVE-2018-17846","published":"2018-10-01","fixed":"0.0.0-20190125091013-d26f9f9a57f3","kev":false},{"cve":"CVE-2019-9512","published":"2019-08-13","fixed":"0.0.0-20190813141303-74dc4d7220e7","kev":false,"link":{"from":"CVE-2018-17846","to":"CVE-2019-9512","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20190125091013-d26f9f9a57f3","toFixed":"0.0.0-20190813141303-74dc4d7220e7","daysApart":316}]}},{"cve":"CVE-2019-9514","published":"2019-08-13","fixed":"0.0.0-20190813141303-74dc4d7220e7","kev":false,"link":{"from":"CVE-2018-17846","to":"CVE-2019-9514","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20190125091013-d26f9f9a57f3","toFixed":"0.0.0-20190813141303-74dc4d7220e7","daysApart":316}]}},{"cve":"CVE-2021-31525","published":"2021-05-27","fixed":"0.0.0-20210428140749-89ef3d95e781","kev":false}],"package":"Go:golang.org/x/net"}}