crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle
    attackers to spoof clients via unspecified vectors. (CVE-2014-7189)

Docker was updated to version 1.3.1 to fix two security issues and several other bugs.

These security issues were fixed :

  - Prevent fallback to SSL protocols lower than TLS 1.0 for     client, daemon and registry (CVE-2014-5277).

  - Secure HTTPS connection to registries with certificate     verification and without HTTP fallback unless     `--insecure-registry` is specified.

These non-security issues were fixed :

  - Fix issue where volumes would not be shared

  - Fix issue with `--iptables=false` not automatically     setting `--ip-masq=false`

  - Fix docker run output to non-TTY stdout

  - Fix escaping `$` for environment variables

  - Fix issue with lowercase `onbuild` Dockerfile     instruction

  - Restrict envrionment variable expansion to `ENV`, `ADD`,     `COPY`, `WORKDIR`, `EXPOSE`, `VOLUME` and `USER`

  - docker `exec` allows you to run additional processes     inside existing containers

  - docker `create` gives you the ability to create a     container via the cli without executing a process

  - `--security-opts` options to allow user to customize     container labels and apparmor profiles

  - docker `ps` filters

  - Wildcard support to copy/add

  - Move production urls to get.docker.com from     get.docker.io

  - Allocate ip address on the bridge inside a valid cidr

  - Use drone.io for pr and ci testing

  - Ability to setup an official registry mirror

  - Ability to save multiple images with docker `save`

go was updated to version 1.3.3 to fix one security issue and several other bugs.

This security issue was fixed :

  - TLS client authentication issue (CVE-2014-7189). These     non-security issues were fixed :

  - Avoid stripping debuginfo on arm, it fails (and is not     necessary)

  - Revert the /usr/share/go/contrib symlink as it caused     problems during update. Moved all go sources to     /usr/share/go/contrib/src instead of     /usr/share/go/contrib/src/pkg and created pkg and src     symlinks in contrib to add it to GOPATH

  - Fixed %go_contribsrcdir value

  - Copy temporary macros.go as go.macros to avoid it to be     built

  - Do not modify Source: files, because that makes the     .src.rpm being tied to one specific arch.

  - Removed extra src folder in /usr/share/go/contrib: the     goal is to transform this folder into a proper entry for     GOPATH. This folder is now linked to     %(_libdir)/go/contrib

  - go requires gcc to build sources using cgo

  - tools-packaging.patch: Allow building cover and vet     tools in $GOROOT_TARGET/pkg/tool instead of     $GOROOT/pkg/tool. This will allow building go tools as a     separate package

update to go1.3.3 (bz1146882)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to go1.3.3 (bz1146882) update to go1.3.2 (bz1147324)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to go1.3.3 (bz1146882) update to go1.3.2 (bz1147324) more work to get cgo.a timestamps to line up, due to build-env

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
428592	Golang: stdlib: security update to 1.3.2	Tenable Cloud Security	Golang	medium
428592	Golang: stdlib: security update to 1.3.2	Tenable Self-Hosted Container Security	Golang	medium
79241	openSUSE Security Update : docker / go (openSUSE-SU-2014:1411-1)	Nessus	SuSE Local Security Checks	medium
79094	Fedora 21 : golang-1.3.3-1.fc21 (2014-14130)	Nessus	Fedora Local Security Checks	medium
78780	Amazon Linux AMI : golang (ALAS-2014-437)	Nessus	Amazon Linux Local Security Checks	medium
78377	Fedora 20 : golang-1.3.3-1.fc20 (2014-12077)	Nessus	Fedora Local Security Checks	medium
78372	Fedora 19 : golang-1.3.3-1.fc19 (2014-11971)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-7189

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium