CVE-2023-24540: 
Docker vulnerability analysis and mitigation

Not all valid JavaScript whitespace characters are considered to be whitespace in Go's html/template package. This vulnerability (CVE-2023-24540) was discovered in early 2023 and affects Go versions prior to 1.19.9 and versions from 1.20.0 up to (excluding) 1.20.4. The issue was reported by Juho Nurminen of Mattermost (Go Advisory, NVD).

The vulnerability occurs when templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The high severity score indicates potential for complete compromise of system confidentiality, integrity, and availability (NetApp Advisory).

The vulnerability has been fixed in Go versions 1.19.9 and 1.20.4. Users are advised to upgrade to these or later versions to address the security issue. The fix was announced in the Go release announcement on May 2, 2023 (Go Announce).