CVE-2024-24785

highPriorität · verfolgen · 0EPSS 0.008 · 56. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.80% (56th) EPSS

CVSS 7.5 · high

Is it mine?

56 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenaardvark-dns-2:1.10.1-2.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenbuildah-2:1.33.14-2.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenbuildah-tests-2:1.33.14-2.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencockpit-podman-0:84.1-1.module+el8.10.0+23963+b64d8032.noarch::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenconmon-3:2.1.10-1.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencontainer-selinux-2:2.229.0-2.module+el8.10.0+23963+b64d8032.noarch::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencontainernetworking-plugins-1:1.4.0-7.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencontainers-common-2:1-82.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencrit-0:3.18-5.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencriu-0:3.18-5.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencriu-devel-0:3.18-5.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencriu-libs-0:3.18-5.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencrun-0:1.14.3-2.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenfuse-overlayfs-0:1.13-1.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibslirp-0:4.4.0-2.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibslirp-devel-0:4.4.0-2.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobennetavark-2:1.10.3-1.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenoci-seccomp-bpf-hook-0:1.2.10-1.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpodman-4:4.9.4-28.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpodman-catatonit-4:4.9.4-28.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpodman-docker-4:4.9.4-28.module+el8.10.0+23963+b64d8032.noarch::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpodman-gvproxy-4:4.9.4-28.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpodman-plugins-4:4.9.4-28.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpodman-remote-4:4.9.4-28.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpodman-tests-4:4.9.4-28.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython3-criu-0:3.18-5.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython3-podman-0:4.9.0-3.module+el8.10.0+23963+b64d8032.noarch::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenrunc-4:1.2.9-3.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenskopeo-2:1.14.5-6.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenskopeo-tests-2:1.14.5-6.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenslirp4netns-0:1.2.3-1.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentoolbox-0:0.0.99.5.1-1.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentoolbox-tests-0:0.0.99.5.1-1.module+el8.10.0+23963+b64d8032.x86_64::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenudica-0:0.2.6-21.module+el8.10.0+23963+b64d8032.noarch::container-tools:rhel8 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NsecondaryAusnutzbarkeit 2.8 · Auswirkung 2.5

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · SUSE Product Security

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1336US

betroffene Produkte (56)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Atlassian Bitbucket <10.0.2alle Versionencert_bundDE
Atlassian Bitbucket <8.19.25 (LTS)alle Versionencert_bundDE
Atlassian Bitbucket <9.4.13 (LTS)alle Versionencert_bundDE
Dell ECS 3.8.1.0-3.8.1.7alle Versionencert_bundDEcpe:/h:dell:ecs:3.8.1.0_-_3.8.1.7
RESF Rocky Linuxalle Versionencert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux 9alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:9
Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
Red Hat OpenShiftalle Versionencert_bundDEcpe:/a:redhat:openshift:-
Red Hat OpenShift CodeReady Workspacesalle Versionencert_bundDEcpe:/a:redhat:openshift:codeready_workspaces
Red Hat OpenShift Container Platform <4.12.72alle Versionencert_bundDE
Red Hat OpenShift Container Platform <4.14.38alle Versionencert_bundDE
Red Hat OpenShift Container Platform <4.16.8alle Versionencert_bundDE
Red Hat OpenShift Custom Metric Autoscaler 2alle Versionencert_bundDEcpe:/a:redhat:openshift:custom_metric_autoscaler_2
Red Hat OpenShift Data Foundation <4.14.13alle Versionencert_bundDE
Red Hat OpenShift GitOps 1.12alle Versionencert_bundDEcpe:/a:redhat:openshift:gitops_1.12
Red Hat OpenShift GitOps <1.15.2alle Versionencert_bundDE
Red Hat OpenShift Kube Descheduler Operator 5alle Versionencert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
Red Hat OpenShift Migration Toolkit for Applications <7.0.3alle Versionencert_bundDE

20 von 56 angezeigt

Advisories (9)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2026:3428security update for aardvark-dns2026-02-26csaf · suse_csafDE
security update for aardvark-dns
WID-SEC-W-2024-0560Golang Go: Mehrere SchwachstellenDeutsch2024-03-05csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um beliebigen Code auszuführen oder um Sicherheitsmaßnahmen zu umgehen.
WID-SEC-W-2024-1226Red Hat OpenShift: Mehrere SchwachstellenDeutsch2024-05-22csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder um weitere nicht spezifizierte Angriffe auszuführen.
WID-SEC-W-2024-1474Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-06-27csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
BIT-golang-2024-24785Errors returned from JSON marshaling may break template escaping in html/template2024-03-12vendor · osvUS
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
CGA-97f2-3j6h-f6fr2024-06-06vendor · osvUS
CGA-q7f3-cq9g-gr7f2024-06-06vendor · osvUS
CGA-wgjf-hp76-8hxw2024-06-06vendor · osvUS
GO-2024-2610Errors returned from JSON marshaling may break template escaping in html/template2024-03-05vendor · osvUS
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

auch bekannt als (9)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund suse_csaf NVD CVE.org MITRE

veröffentlicht 2024-03-05geändert 2026-06-17

Referenzen (15)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan