Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before     0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed     X.509 certificate. (CVE-2020-7919)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before
    0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed
    X.509 certificate. (CVE-2020-7919)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to
    v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads,
    causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable.
    Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger
    this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by
    default for backwards compatibility. (CVE-2019-11253)

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to
    libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with
    custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect
    Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve
    Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-
    signing certificate to sign a malicious executable, making it appear the file was from a trusted,
    legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'. (CVE-2020-0601)

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before
    0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed
    X.509 certificate. (CVE-2020-7919)

Multiple security issues were discovered in the implementation of the Go programming language, which could result in denial of service and the P-224 curve implementation could generate incorrect outputs.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data     race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a     request body and writes a response at the same     time.(CVE-2020-15586)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP     Request Smuggling.(CVE-2019-16276)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic     upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack     scenarios, such as traffic from a client to a server     that verifies client certificates.(CVE-2019-17596)

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the     crypto/cryptobyte package before     0.0.0-20200124225646-8b5121be2f68 for Go) allows     attacks on clients (resulting in a panic) via a     malformed X.509 certificate.(CVE-2020-7919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the go package has been released.

- Rebase to go1.13.9

  - Security fix for CVE-2020-7919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
250382	Linux Distros Unpatched Vulnerability : CVE-2020-7919	Nessus	Misc.	high
431925	SCA: security update for github.com/helm/helm, golang.org/x/crypto, helm.sh/helm/v3 (GHSA-cjjc-xp8v-855w)	Tenable Cloud Security	SCA Checks	high
431925	SCA: security update for github.com/helm/helm, golang.org/x/crypto, helm.sh/helm/v3 (GHSA-cjjc-xp8v-855w)	Tenable Self-Hosted Container Security	SCA Checks	high
428557	Golang: stdlib: security update to 1.12.16stdlib: security update to 1.13.7	Tenable Cloud Security	Golang	high
428557	Golang: stdlib: security update to 1.12.16stdlib: security update to 1.13.7	Tenable Self-Hosted Container Security	Golang	high
426572	Alpine: multiple containerd packages: security update to 1.3.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426572	Alpine: multiple containerd packages: security update to 1.3.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404737	Alpine: multiple go packages: security update to 1.13.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404737	Alpine: multiple go packages: security update to 1.13.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403888	Alpine: multiple containerd packages: security update to 1.3.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403888	Alpine: multiple containerd packages: security update to 1.3.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400401	Alpine: multiple go packages: security update to 1.13.4-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400401	Alpine: multiple go packages: security update to 1.13.4-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
146371	Debian DSA-4848-1 : golang-1.11 - security update	Nessus	Debian Local Security Checks	medium
139134	EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-1804)	Nessus	Huawei Local Security Checks	high
136575	Photon OS 3.0: Go PHSA-2020-3.0-0087	Nessus	PhotonOS Local Security Checks	high
136553	Photon OS 1.0: Go PHSA-2020-1.0-0292	Nessus	PhotonOS Local Security Checks	high
136327	Photon OS 2.0: Go PHSA-2020-2.0-0238	Nessus	PhotonOS Local Security Checks	high
135369	Fedora 31 : golang (2020-12bc5b5597)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-7919

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high