Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

An update of the go package has been released.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 20.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in Oracle NoSQL Database (component: Administration (Node.js)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle NoSQL Database.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle NoSQL Database. (CVE-2021-22883)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (jackson-databind)).
    This vulnerability cannot be exploited in the context of this product. (CVE-2019-14379)

  - Vulnerability in Oracle NoSQL Database (component: Administration (Google Guava)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle NoSQL Database executes to compromise     Oracle NoSQL Database. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle NoSQL Database accessible data. (CVE-2020-8908)   
  - Vulnerability in Oracle NoSQL Database (component: Administration (Netty)). The supported version     that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle NoSQL Database. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle NoSQL Database. (CVE-2020-11612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4758-1 advisory.

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5493 advisory.

  - golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)

  - golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

  - golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

  - golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Some HTTP/2 implementations are vulnerable to ping     floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer,     causing the peer to build an internal queue of     responses. Depending on how efficiently this data is     queued, this can consume excess CPU, memory, or     both.(CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to a reset     flood, potentially leading to a denial of service. The     attacker opens a number of streams and sends an invalid     request over each stream that should solicit a stream     of RST_STREAM frames from the peer. Depending on how     the peer queues the RST_STREAM frames, this can consume     excess memory, CPU, or both.(CVE-2019-9514)

  - Go before 1.13.15 and 14.x before 1.14.7 can have an     infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs.(CVE-2020-16845)

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS     because text/html is the default for CGI/FCGI handlers     that lack a Content-Type header.(CVE-2020-24553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5493 advisory.

  - Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. (CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. (CVE-2020-28367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5493 advisory.

  - golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)

  - golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

  - golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

  - golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS     because text/html is the default for CGI/FCGI handlers     that lack a Content-Type header.(CVE-2020-24553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.14 fixes the following issues :

go1.14.9 (released 2020-09-09) includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. Refs bsc#1164903 go1.14 release tracking

  - go#41192 net/http/fcgi: race detected during execution     of TestResponseWriterSniffsContentType test

  - go#41016 net/http: Transport.CancelRequest no longer     cancels in-flight request

  - go#40973 net/http: RoundTrip unexpectedly changes     Request

  - go#40968 runtime: checkptr incorrectly -race flagging     when using &^ arithmetic

  - go#40938 cmd/compile: R12 can be clobbered for write     barrier call on PPC64

  - go#40848 testing: '=== PAUSE' lines do not change the     test name for the next log line

  - go#40797 cmd/compile: inline marker targets not     reachable after assembly on arm

  - go#40766 cmd/compile: inline marker targets not     reachable after assembly on ppc64x

  - go#40501 cmd/compile: for range loop reading past slice     end

  - go#40411 runtime: Windows service lifecycle events     behave incorrectly when called within a golang     environment

  - go#40398 runtime: fatal error: checkdead: runnable g

  - go#40192 runtime: pageAlloc.searchAddr may point to     unmapped memory in discontiguous heaps, violating its     invariant

  - go#39955 cmd/link: incorrect GC bitmap when global's     type is in another shared object

  - go#39690 cmd/compile: s390x floating point <-> integer     conversions clobbering the condition code

  - go#39279 net/http: Re-connect with upgraded HTTP2     connection fails to send Request.body

  - go#38904 doc: include fix for #34437 in Go 1.14 release     notes

go1.14.8 (released 2020-09-01) includes security fixes to the net/http/cgi and net/http/fcgi packages. CVE-2020-24553 Refs bsc#1164903 go1.14 release tracking

  - bsc#1176031 CVE-2020-24553

  - go#41164 net/http/cgi,net/http/fcgi: Cross-Site     Scripting (XSS) when Content-Type is not specified

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

go1.15 (released 2020-08-11) Go 1.15 is a major release of Go.

go1.15.x minor releases will be provided through August 2021.

https://github.com/golang/go/wiki/Go-Release-Cycle

Most changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before.

See release notes https://golang.org/doc/go1.15. Excerpts relevant to OBS environment and for SUSE/openSUSE follow :

Module support in the go command is ready for production use, and we encourage all users to migrate to Go modules for dependency management.

Module cache: The location of the module cache may now be set with the GOMODCACHE environment variable. The default value of GOMODCACHE is GOPATH[0]/pkg/mod, the location of the module cache before this change.

Compiler flag parsing: Various flag parsing issues in go test and go vet have been fixed. Notably, flags specified in GOFLAGS are handled more consistently, and the -outputdir flag now interprets relative paths relative to the working directory of the go command (rather than the working directory of each individual test).

The GOPROXY environment variable now supports skipping proxies that return errors. Proxy URLs may now be separated with either commas (,) or pipe characters (|). If a proxy URL is followed by a comma, the go command will only try the next proxy in the list after a 404 or 410 HTTP response. If a proxy URL is followed by a pipe character, the go command will try the next proxy in the list after any error. Note that the default value of GOPROXY remains https://proxy.golang.org,direct, which does not fall back to direct in case of errors.

On a Unix system, if the kill command or kill system call is used to send a SIGSEGV, SIGBUS, or SIGFPE signal to a Go program, and if the signal is not being handled via os/signal.Notify, the Go program will now reliably crash with a stack trace. In earlier releases the behavior was unpredictable.

Allocation of small objects now performs much better at high core counts, and has lower worst-case latency.

Go 1.15 reduces typical binary sizes by around 5% compared to Go 1.14 by eliminating certain types of GC metadata and more aggressively eliminating unused type metadata.

The toolchain now mitigates Intel CPU erratum SKX102 on GOARCH=amd64 by aligning functions to 32 byte boundaries and padding jump instructions. While this padding increases binary sizes, this is more than made up for by the binary size improvements mentioned above.

Go 1.15 adds a -spectre flag to both the compiler and the assembler, to allow enabling Spectre mitigations. These should almost never be needed and are provided mainly as a 'defense in depth' mechanism. See the Spectre Go wiki page for details.

The compiler now rejects //go: compiler directives that have no meaning for the declaration they are applied to with a 'misplaced compiler directive' error. Such misapplied directives were broken before, but were silently ignored by the compiler.

Substantial improvements to the Go linker, which reduce linker resource usage (both time and memory) and improve code robustness/maintainability. Linking is 20% faster and requires 30% less memory on average. These changes are part of a multi-release project to modernize the Go linker, meaning that there will be additional linker improvements expected in future releases.

The linker now defaults to internal linking mode for

-buildmode=pie on linux/amd64 and linux/arm64, so these configurations no longer require a C linker.

There has been progress in improving the stability and performance of the 64-bit RISC-V port on Linux (GOOS=linux, GOARCH=riscv64). It also now supports asynchronous preemption.

crypto/x509: The deprecated, legacy behavior of treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable. Note that if the CommonName is an invalid host name, it's always ignored, regardless of GODEBUG settings. Invalid names include those with any characters other than letters, digits, hyphens and underscores, and those with empty labels or trailing dots.

crypto/x509: go1.15 applications with an AWS DB instance that was created or updated to the rds-ca-2019 certificate prior to July 28, 2020, you must update the certificate again. If you created your DB instance or updated its certificate after July 28, 2020, no action is required. For more information, see go#39568

This update ships go1.15.2 (released 2020-09-09) includes fixes to the compiler, runtime, documentation, the go command, and the net/mail, os, sync, and testing packages.

go#41193 net/http/fcgi: race detected during execution of TestResponseWriterSniffsContentType test

go#41178 doc: include fix for #34437 in Go 1.14 release notes

go#41034 testing: Cleanup races with Logf and Errorf

go#41011 sync: sync.Map keys will never be garbage collected

go#40934 runtime: checkptr incorrectly -race flagging when using &^ arithmetic

go#40900 internal/poll: CopyFileRange returns EPERM on CircleCI Docker Host running 4.10.0-40-generic

go#40868 cmd/compile: R12 can be clobbered for write barrier call on PPC64

go#40849 testing: '=== PAUSE' lines do not change the test name for the next log line

go#40845 runtime: Panic if newstack at runtime.acquireLockRank

go#40805 cmd/test2json: tests that panic are marked as passing

go#40804 net/mail: change in behavior of ParseAddressList('') in 1.15

go#40802 cmd/go: in 1.15: change in 'go test' argument parsing

go#40798 cmd/compile: inline marker targets not reachable after assembly on arm

go#40772 cmd/compile: compiler crashes in ssa: isNonNegative bad type

go#40767 cmd/compile: inline marker targets not reachable after assembly on ppc64x

go#40739 internal/poll: CopyFileRange returns ENOTSUP on Linux 3.10.0 kernel on NFS mount

go#40412 runtime: Windows service lifecycle events behave incorrectly when called within a golang environment

go1.15.1 (released 2020-09-01) includes security fixes to the net/http/cgi and net/http/fcgi packages.

bsc#1176031 CVE-2020-24553: go net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified

go#41165 net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1445 advisory.

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1554 advisory.

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for go1.14 fixes the following issues :

  - go1.14.9 (released 2020-09-09) includes fixes to the     compiler, linker, runtime, documentation, and the     net/http and testing packages. Refs bsc#1164903 go1.14     release tracking

  - go#41192 net/http/fcgi: race detected during execution     of TestResponseWriterSniffsContentType test

  - go#41016 net/http: Transport.CancelRequest no longer     cancels in-flight request

  - go#40973 net/http: RoundTrip unexpectedly changes     Request

  - go#40968 runtime: checkptr incorrectly -race flagging     when using &^ arithmetic

  - go#40938 cmd/compile: R12 can be clobbered for write     barrier call on PPC64

  - go#40848 testing: '=== PAUSE' lines do not change the     test name for the next log line

  - go#40797 cmd/compile: inline marker targets not     reachable after assembly on arm

  - go#40766 cmd/compile: inline marker targets not     reachable after assembly on ppc64x

  - go#40501 cmd/compile: for range loop reading past slice     end

  - go#40411 runtime: Windows service lifecycle events     behave incorrectly when called within a golang     environment

  - go#40398 runtime: fatal error: checkdead: runnable g

  - go#40192 runtime: pageAlloc.searchAddr may point to     unmapped memory in discontiguous heaps, violating its     invariant

  - go#39955 cmd/link: incorrect GC bitmap when global's     type is in another shared object

  - go#39690 cmd/compile: s390x floating point <-> integer     conversions clobbering the condition code

  - go#39279 net/http: Re-connect with upgraded HTTP2     connection fails to send Request.body

  - go#38904 doc: include fix for #34437 in Go 1.14 release     notes

  - go1.14.8 (released 2020-09-01) includes security fixes     to the net/http/cgi and net/http/fcgi packages.
    CVE-2020-24553 Refs bsc#1164903 go1.14 release tracking

  - bsc#1176031 CVE-2020-24553

  - go#41164 net/http/cgi,net/http/fcgi: Cross-Site     Scripting (XSS) when Content-Type is not specified This     update was imported from the SUSE:SLE-15:Update update     project.

The Go project reports :

When a Handler does not explicitly set the Content-Type header, both CGI implementations default to 'text/html'. If an attacker can make a server generate content under their control (e.g. a JSON containing user data or an uploaded image file) this might be mistakenly returned by the server as 'text/html'. If a victim visits such a page they could get the attacker's code executed in the context of the server origin. If an attacker can make a server generate content under their control (e.g. a JSON containing user data or an uploaded image file) this might be mistakenly returned by the server as 'text/html'. If a victim visits such a page they could get the attacker's code executed in the context of the server origin.

ID	Name	Product	Family	Severity
150285	Photon OS 3.0: Go PHSA-2021-3.0-0248	Nessus	PhotonOS Local Security Checks	medium
148977	Oracle NoSQL Database Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	critical
148004	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Go vulnerability (USN-4758-1)	Nessus	Ubuntu Local Security Checks	medium
145933	CentOS 8 : go-toolset:rhel8 (CESA-2020:5493)	Nessus	CentOS Local Security Checks	high
145182	EulerOS 2.0 SP3 : golang (EulerOS-SA-2021-1073)	Nessus	Huawei Local Security Checks	medium
144562	Oracle Linux 8 : go-toolset:ol8 (ELSA-2020-5493)	Nessus	Oracle Linux Local Security Checks	high
144407	RHEL 8 : go-toolset:rhel8 (RHSA-2020:5493)	Nessus	Red Hat Local Security Checks	high
144268	EulerOS 2.0 SP5 : golang (EulerOS-SA-2020-2548)	Nessus	Huawei Local Security Checks	medium
144128	EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-2512)	Nessus	Huawei Local Security Checks	medium
143750	SUSE SLED15 / SLES15 Security Update : go1.14 (SUSE-SU-2020:2761-1)	Nessus	SuSE Local Security Checks	medium
143651	SUSE SLED15 / SLES15 Security Update : go1.15 (SUSE-SU-2020:2776-1)	Nessus	SuSE Local Security Checks	medium
142981	Amazon Linux AMI : golang (ALAS-2020-1445)	Nessus	Amazon Linux Local Security Checks	medium
142723	Amazon Linux 2 : golang (ALAS-2020-1554)	Nessus	Amazon Linux Local Security Checks	medium
141162	openSUSE Security Update : go1.14 (openSUSE-2020-1587)	Nessus	SuSE Local Security Checks	medium
141160	openSUSE Security Update : go1.14 (openSUSE-2020-1584)	Nessus	SuSE Local Security Checks	medium
140135	FreeBSD : go -- net/http/cgi, net/http/fcgi: XSS (XSS) when Content-Type is not specified (67b050ae-ec82-11ea-9071-10c37b4ac2ea)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-24553

medium

Tenable Plugins

medium

critical

medium

high

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium