x/vulndb: potential Go vuln in "Go Standard Library (package not identified)": CVE-2018-17847

[GoVulnBot]

In CVE-2018-17847, the reference URL [Go Standard Library (package not identified)](Go Standard Library (package not identified)) (and possibly others) refers to something in Go.

module: std
package: Go Standard Library (package not identified)
description: |
  The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.
cves:
- CVE-2018-17847
links:
  context:
  - https://go.dev/issue/27846
  - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/
  - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/

See doc/triage.md
for instructions on how to triage this report.

[gopherbot]

Change https://go.dev/cl/415275 mentions this issue: x/vulndb: add reports/GO-2022-0197.yaml for CVE-2018-17847

[neild]

CVE-2018-17848 is a dup of this issue.

[tatianab]

Review for appropriate use of alias vs related