The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0060 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-14809:
    net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a hostname of google.com.

    CVE-2020-14040:
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.

    CVE-2020-28362:
    Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. A flaw was found in the math/big     package of Go's standard library that causes a denial of service. Applications written in Go that use     math/big via cryptographic packages, including crypto/rsa and crypto/x509, are vulnerable and can     potentially cause panic via a crafted certificate chain. The highest threat from this vulnerability is to     system availability.

    CVE-2020-28366:
    Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. An input validation vulnerability was     found in Go. From a generated go file (from the cgo tool), it is possible to modify symbols within that     object file and specify code. This flaw allows an attacker to create a repository that includes malicious     pre-built object files that could execute arbitrary code when downloaded and run via `go get` or `go     build` while building a Go project. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability.

    CVE-2020-28367:
    Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. An input validation vulnerability     was found in Go. If cgo is specified in a Go file, it is possible to bypass the validation of arguments to     the gcc compiler. This flaw allows an attacker to create a malicious repository that can execute arbitrary     code when downloaded and run via `go get` or `go build` while building a Go project. The highest threat     from this vulnerability is to confidentiality and integrity as well as system availability.

    CVE-2021-3114:
    In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field. A flaw     detected in golang: crypto/elliptic, in which P-224 keys as generated can return incorrect inputs,     reducing the strength of the cryptography. The highest threat from this vulnerability is confidentiality     and integrity.

    CVE-2021-27918:
    encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader     (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode,     DecodeElement, or Skip method.

    CVE-2021-31525:
    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations.

    CVE-2021-33196:
    In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic.

    CVE-2021-34558:
    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0013 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10214:
    The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise     Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the     container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack     and steal login credentials or bearer tokens.

    CVE-2019-18466:
    An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2020-10696:
    A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions.

    CVE-2020-14040:
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.

    CVE-2020-14370:
    An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When     using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in     a short duration, the environment variables from the first container will get leaked into subsequent     containers. An attacker who has control over the subsequent containers could use this flaw to gain access     to sensitive information stored in such variables.

    CVE-2020-1702:
    A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

    CVE-2020-1726:
    A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. (CVE-2020-14040)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5606 advisory.

    Red Hat OpenShift Container Storage is software-defined storage integrated with and optimized for the Red     Hat OpenShift Container Platform. Red Hat OpenShift Container Storage is a highly scalable, production-     grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In     addition to persistent storage, Red Hat OpenShift Container Storage provisions a multicloud data     management service with an S3 compatible API.

    These updated packages include numerous security fixes, bug fixes, and     enhancements.

    Security Fix(es):

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    * golang: data race in certain net/http servers including ReverseProxy can lead to DoS (CVE-2020-15586)

    * golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs     (CVE-2020-16845)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    These updated packages include numerous bug fixes and enhancements. Users are     directed to the Red Hat OpenShift Container Storage Release Notes for     information on the most significant of these changes:

    https://access.redhat.com/documentation/en-     us/red_hat_openshift_container_storage/4.6/html/4.6_release_notes/index

    All Red Hat OpenShift Container Storage users are advised to upgrade to these     updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4694 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

  - The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. (CVE-2020-14040)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4694 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. (CVE-2020-14040)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5873-1 advisory.

    It was discovered that Go Text incorrectly handled certain encodings. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2020-14040)

    It was discovered that Go Text incorrectly handled certain BCP 47 language tags. An attacker could     possibly use this issue to cause a denial of service. CVE-2020-28851, CVE-2020-28852 and CVE-2021-38561     affected only Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28851, CVE-2020-28852, CVE-2021-38561,     CVE-2022-32149)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4694 advisory.

  - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

  - QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

  - golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:3665 advisory.

  - golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

  - golang: data race in certain net/http servers including ReverseProxy can lead to DoS (CVE-2020-15586)

  - golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs     (CVE-2020-16845)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5054 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5056 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    * podman: environment variables leak between containers when started via Varlink or Docker-compatible REST     API (CVE-2020-14370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * podman does not use $TMPDIR loading a tar file (BZ#1877699)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5055 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4694 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

    * QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4297 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * jenkins-jira-plugin: plugin information disclosure (CVE-2019-16541)

    * jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM     (CVE-2020-2252)

    * jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read     arbitrary files (CVE-2020-2254)

    * jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP     endpoints implementing connection tests. (CVE-2020-2255)

    * kubernetes: Docker config secrets leaked when file is malformed and loglevel >= 4 (CVE-2020-8564)

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    * podman: environment variables leak between containers when started via Varlink or Docker-compatible REST     API (CVE-2020-14370)

    * golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs     (CVE-2020-16845)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.13.15-1.59. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1436 advisory.

    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. A denial of service vulnerability was found in the golang.org/x/text     library. A library or application must use one of the vulnerable functions, such as unicode.Transform,     transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to     supply specific characters or strings to the vulnerable application, there is the potential to cause an     infinite loop to occur using more memory, resulting in a denial of service. (CVE-2020-14040)

    Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs. (CVE-2020-16845)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4214 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    * golang: data race in certain net/http servers including ReverseProxy can lead to DoS (CVE-2020-15586)

    * golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs     (CVE-2020-16845)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * net/http, x/net/http2: http server shutdown doesn't gracefully shut down HTTP2 connections (BZ#1879236)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.13.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1494 advisory.

    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.A denial of service vulnerability was found in the golang.org/x/text     library. A library or application must use one of the vulnerable functions, such as unicode.Transform,     transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to     supply specific characters or strings to the vulnerable application, there is the potential to cause an     infinite loop to occur using more memory, resulting in a denial of service. (CVE-2020-14040)

    Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs. (CVE-2020-16845)



Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3665 advisory.

    golang     [1.13.15-1]
    - Rebase to 1.13.15
    - Related: rhbz#1865875
    - Related: rhbz#1865873

    go-toolset     [1.13.15-1]
    - Rebase to 1.13.15
    - Related: rhbz#1865875
    - Related: rhbz#1865873

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3665 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    * golang: data race in certain net/http servers including ReverseProxy can lead to DoS (CVE-2020-15586)

    * golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs     (CVE-2020-16845)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New package version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3369 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic (CVE-2020-9283)

    * nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)

    * jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code     execution (CVE-2020-11023)

    * macaron: open redirect in the static handler (CVE-2020-12666)

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236611	Alibaba Cloud Linux 3 : 0060: go-toolset:rhel8 (ALINUX3-SA-2021:0060)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
236549	Alibaba Cloud Linux 3 : 0013: container-tools:rhel8 (ALINUX3-SA-2021:0013)	Nessus	Alibaba Cloud Linux Local Security Checks	high
223217	Linux Distros Unpatched Vulnerability : CVE-2020-14040	Nessus	Misc.	high
194282	RHEL 8 : Red Hat OpenShift Container Storage 4.6 update (Moderate) (RHSA-2020:5606)	Nessus	Red Hat Local Security Checks	high
185064	Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:4694)	Nessus	Rocky Linux Local Security Checks	medium
180889	Oracle Linux 8 : container-tools:ol8 (ELSA-2020-4694)	Nessus	Oracle Linux Local Security Checks	medium
171575	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Go Text vulnerabilities (USN-5873-1)	Nessus	Ubuntu Local Security Checks	high
145914	CentOS 8 : container-tools:rhel8 (CESA-2020:4694)	Nessus	CentOS Local Security Checks	medium
145887	CentOS 8 : go-toolset:rhel8 (CESA-2020:3665)	Nessus	CentOS Local Security Checks	high
142702	RHEL 7 : skopeo (RHSA-2020:5054)	Nessus	Red Hat Local Security Checks	high
142698	RHEL 7 : podman (RHSA-2020:5056)	Nessus	Red Hat Local Security Checks	medium
142697	RHEL 7 : buildah (RHSA-2020:5055)	Nessus	Red Hat Local Security Checks	high
142451	RHEL 8 : container-tools:rhel8 (RHSA-2020:4694)	Nessus	Red Hat Local Security Checks	medium
142002	RHEL 7 / 8 : OpenShift Container Platform 4.6.1 (RHSA-2020:4297)	Nessus	Red Hat Local Security Checks	critical
141969	Amazon Linux AMI : golang (ALAS-2020-1436)	Nessus	Amazon Linux Local Security Checks	high
141307	RHEL 7 : go-toolset-1.13-golang (RHSA-2020:4214)	Nessus	Red Hat Local Security Checks	high
141107	Amazon Linux 2 : golang (ALAS-2020-1494)	Nessus	Amazon Linux Local Security Checks	high
140524	Oracle Linux 8 : go-toolset:ol8 (ELSA-2020-3665)	Nessus	Oracle Linux Local Security Checks	high
140391	RHEL 8 : go-toolset:rhel8 (RHSA-2020:3665)	Nessus	Red Hat Local Security Checks	high
140308	Fedora 32 : golang (2020-a55f130272)	Nessus	Fedora Local Security Checks	high
139385	RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:3369)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-14040

high

Tenable Plugins

critical

high

high

high

medium

medium

high

medium

high

high

medium

high

medium

critical

high

high

high

high

high

high

high