GoSIG / go-sig

#52 CVE-2023-3978 golang.org/x/net/html rebuild
Opened by mikelo2. Modified

Open
Close Issue

Multiple BZs have been opened for packages that depend on golang.org/x/net/html because of https://nvd.nist.gov/vuln/detail/CVE-2023-3978

A fast search including -devel only packages:

dnf repoquery --repo=rawhide{,-source} --whatrequires 'golang(golang.org/x/net/html)' | grep '\.src$' | pkgname | sort -u 
aquatone
bettercap
douceur
golang-github-andybalholm-cascadia
golang-github-antchfx-htmlquery
golang-github-appc-spec
golang-github-aws-sdk-2
golang-github-chris-ramon-douceur
golang-github-client9-gospell
golang-github-client9-plaintext
golang-github-gabriel-vasile-mimetype
golang-github-gocolly-colly-2
golang-github-google-go-github
golang-github-kennygrant-sanitize
golang-github-microcosm-cc-bluemonday
golang-github-niklasfasching-org
golang-github-puerkitobio-goquery
golang-jaytaylor-html2text
golang-k8s-apimachinery
golang-x-tools
htmltest
hugo
onionscan
rclone
xq

I already built a new version of golang-x-net that fixes the CVE, now those packages should be rebuilt.

IIRC someone worked on a script to automate the rebuild for this kind of scenario. Pinging @gotmax23 & @fale in case they remember if that script exists.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.