Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

An update of the falco package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go
    1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. (CVE-2022-29804)

An update of the kubernetes package has been released.

An update of the go package has been released.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go
    1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. (CVE-2022-29804)

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12
    and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly
    fails to reject the header as invalid. (CVE-2022-1705)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an
    attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker
    to cause a panic due to stack exhaustion via a deeply nested XML document. (CVE-2022-28131)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2312-1 advisory.

    - Add subpackage go1.x-libstd compiled shared object libstd.so (jsc#PED-1962)
      * Main go1.x package included libstd.so in previous versions
      * Split libstd.so into subpackage that can be installed standalone
      * Continues the slimming down of main go1.x package by 40 Mb
      * Experimental and not recommended for general use, Go currently has no ABI
      * Upstream Go has not committed to support buildmode=shared long-term
      * Do not use in packaging, build static single binaries (the default)
      * Upstream Go go1.x binary releases do not include libstd.so
      * go1.x Suggests go1.x-libstd so not installed by default Recommends
      * go1.x-libstd does not Require: go1.x so can install standalone
      * Provides go-libstd unversioned package name
      * Fix build step -buildmode=shared std to omit -linkshared
    - Packaging improvements:
      * go1.x Suggests go1.x-doc so not installed by default Recommends
      * Use Group: Development/Languages/Go instead of Other

    - Improvements to go1.x packaging spec:
      * On Tumbleweed bootstrap with current default gcc13 and gccgo118
      * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap         using go1.x package (%bcond_without gccgo). This is no longer         needed on current SLE-12:Update and removing will consolidate         the build configurations used.
      * Change source URLs to go.dev as per Go upstream
      * On x86_64 export GOAMD64=v1 as per the current baseline.
        At this time forgo GOAMD64=v3 option for x86_64_v3 support.
      * On x86_64 %define go_amd64=v1 as current instruction baseline

    - Update to version 1.18.10.1 cut from the go1.18-openssl-fips       branch at the revision tagged go1.18.10-1-openssl-fips.
      * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
      * Merge go1.18.10 into dev.boringcrypto.go1.18

    - go1.18.10 (released 2023-01-10) includes fixes to cgo, the       compiler, the linker, and the crypto/x509, net/http, and syscall       packages.
      Refs bsc#1193742 go1.18 release tracking
      * go#57705 misc/cgo: backport needed for dlltool fix
      * go#57426 crypto/x509: Verify on macOS does not return typed errors
      * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its     'old' argument.
      * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2     ARM devices
      * go#57213 os: TestLstat failure on Linux Aarch64
      * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with     reflect.MakeFunc and slice of sufficient length
      * go#57057 cmd/go: remove test dependency on gopkg.in service
      * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
      * go#57044 cgo: malformed DWARF TagVariable entry
      * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
      * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
      * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
      * go#56323 net/http: bad handling of HEAD requests with a body

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve     Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-     signing certificate to sign a malicious executable, making it appear the file was from a trusted,     legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'. (CVE-2020-0601)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - In filepath.Clean in path/filepath in Go before 1.17.11 and 1.18.x before 1.18.3 on Windows, invalid paths     such as .\c: could be converted to valid paths (such as c: in this example). (CVE-2022-29804)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In filepath.Clean in path/filepath in Go before 1.17.11 and 1.18.x before 1.18.3 on Windows, invalid paths     such as .\c: could be converted to valid paths (such as c: in this example). (CVE-2022-29804)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - In Decoder.Skip in encoding/xml in Go before 1.17.12 and 1.18.x before 1.18.4, stack exhaustion and a     panic can occur via a deeply nested XML document. (CVE-2022-28131)

  - Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero     flags parameter, the Faccessat function could incorrectly report that a file is accessible.
    (CVE-2022-29526)

  - In filepath.Clean in path/filepath in Go before 1.17.11 and 1.18.x before 1.18.3 on Windows, invalid paths     such as .\c: could be converted to valid paths (such as c: in this example). (CVE-2022-29804)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-17956 advisory.

    go-toolset     [1.18.3-1]
    - Update to golang 1.18.3

    golang     [1.18.3-1.0.1]
    - Rebase to 1.18.3 by adding upstream patches to the 1.18.0 openssl-fips
    - Modify Patch51852 to remove portions already upstream
    - Use base_version to distinguish the version of the tarball from the       final version
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [1.18.1-2.0.1]
    - Rebase to 1.18.0 openssl-fips
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [1.17.10-1.0.1]
    - Add patches between Go 1.17.7 and Go 1.17.10
    - Rename base_versn to base_version
    - Remove unneeded patches from previous version
    - Remove Patch2028662 because that patch is also upstream now
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    delve     [1.8.3-1.0.1]
    - Bump version of delve from 1.7.2 to 1.8.3

    [1.7.2-1.0.1]
    - Bump version of delve from 1.6.0 to 1.7.2, enable aarch64

    [1.6.0-1.0.1]
    - Bump upstream version of delve from 1.5.0 to 1.6.0

    [1.5.0-2.0.1]
    - Cherry pick 05508ea98055bcb5418d2dc83893af4eb044d151:
      + Disable DWARF compression which has issues (Alex Burmashev)       + By David Sloboda <david.x.sloboda@oracle.com>

    [1.5.0-2]
    - Add golang-1.15.4 related patch
    - Resolves: rhbz#1901189

    [1.5.0-1]
    - Rebase to 1.5.0
    - Related: rhbz#1870531

    [1.4.1-1]
    - Rebase to 1.4.1
    - Resolves: rhbz#1821281
    - Related: rhbz#1820596

    [1.4.0-2]
    - Change i686 to a better macro
    - Related: rhbz#1820596

    [1.4.0-1]
    - Rebase to 1.4.0
    - Remove Patch1781
    - Related: rhbz#1820596

    [1.3.2-3]
    - Resolves: rhbz#1758612
    - Resolves: rhbz#1780554
    - Add patch: 1781-pkg-terminal-Fix-exit-status.patch

    [1.3.2-2]
    - Added tests
    - Related: rhbz#1758612

    [1.3.2-1]
    - First package for RHEL
    - Related: rhbz#1758612

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-17957 advisory.

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

  - Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom     application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the     case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI.
    In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application     images were found to have no authentication (in the form of firmware signing) and only relied on insecure     checksums for regular integrity checks. (CVE-2022-30269)

  - Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go     1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. (CVE-2022-29804)

  - Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in     the working directory named either ..com or ..exe by calling Cmd.Run, Cmd.Start, Cmd.Output, or     Cmd.CombinedOutput when Cmd.Path is unset. (CVE-2022-30580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2004-1 advisory.

  - Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go     1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. (CVE-2022-29804)

  - Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in     the working directory named either ..com or ..exe by calling Cmd.Run, Cmd.Start, Cmd.Output, or     Cmd.CombinedOutput when Cmd.Path is unset. (CVE-2022-30580)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2005-1 advisory.

  - Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go     1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. (CVE-2022-29804)

  - Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in     the working directory named either ..com or ..exe by calling Cmd.Run, Cmd.Start, Cmd.Output, or     Cmd.CombinedOutput when Cmd.Path is unset. (CVE-2022-30580)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 15888c7e-e659-11ec-b7fe-10c37b4ac2ea advisory.

  - The Go project reports: crypto/rand: rand.Read hangs with extremely large buffers On Windows, rand.Read     will hang indefinitely if passed a             buffer larger than 1 << 32 - 1 bytes. crypto/tls: session     tickets lack random ticket_age_add Session tickets generated by crypto/tls did not contain             a     randomly generated ticket_age_add. This allows an             attacker that can observe TLS handshakes to     correlate             successive connections by comparing ticket ages during             session     resumption. os/exec: empty Cmd.Path can result in running unintended             binary on Windows If, on     Windows, Cmd.Run, cmd.Start, cmd.Output, or             cmd.CombinedOutput are executed when Cmd.Path is     unset             and, in the working directory, there are binaries named             either ..com or     ..exe, they will be executed. path/filepath: Clean(`.\c:`) returns `c:` on Windows On Windows, the     filepath.Clean function could convert an             invalid path to a valid, absolute path. For example,     Clean(`.\c:`) returned `c:`. (CVE-2022-29804, CVE-2022-30580, CVE-2022-30629, CVE-2022-30634)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333878	Photon OS 5.0: Falco PHSA-2023-5.0-91-0046	Nessus	PhotonOS Local Security Checks	Local	critical
428539	Golang: stdlib: security update to 1.17.11stdlib: security update to 1.18.3	Tenable Cloud Security	Golang	Local	high
428539	Golang: stdlib: security update to 1.17.11stdlib: security update to 1.18.3	Tenable Self-Hosted Container Security	Golang	Local	high
204385	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0419	Nessus	PhotonOS Local Security Checks	Local	critical
204254	Photon OS 5.0: Falco PHSA-2023-5.0-0046	Nessus	PhotonOS Local Security Checks	Local	critical
203948	Photon OS 3.0: Falco PHSA-2023-3.0-0611	Nessus	PhotonOS Local Security Checks	Local	critical
203301	Photon OS 4.0: Go PHSA-2022-4.0-0242	Nessus	PhotonOS Local Security Checks	Local	high
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	Combined	critical
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	Combined	critical
404765	Alpine: multiple go packages: security update to 1.18.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
404765	Alpine: multiple go packages: security update to 1.18.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
176517	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.18-openssl (SUSE-SU-2023:2312-1)	Nessus	SuSE Local Security Checks	Local	high
167392	EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2766)	Nessus	Huawei Local Security Checks	Local	high
167364	EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2731)	Nessus	Huawei Local Security Checks	Local	high
166979	EulerOS 2.0 SP5 : golang (EulerOS-SA-2022-2710)	Nessus	Huawei Local Security Checks	Local	high
166869	EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-2683)	Nessus	Huawei Local Security Checks	Local	high
166813	EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-2651)	Nessus	Huawei Local Security Checks	Local	high
163040	Oracle Linux 8 : go-toolset:ol8addon (ELSA-2022-17956)	Nessus	Oracle Linux Local Security Checks	Local	high
163027	Oracle Linux 8 : ol8addon (ELSA-2022-17957)	Nessus	Oracle Linux Local Security Checks	Local	high
161943	SUSE SLED15 / SLES15 Security Update : go1.17 (SUSE-SU-2022:2004-1)	Nessus	SuSE Local Security Checks	Local	high
161941	SUSE SLED15 / SLES15 Security Update : go1.18 (SUSE-SU-2022:2005-1)	Nessus	SuSE Local Security Checks	Local	high
161926	FreeBSD : go -- multiple vulnerabilities (15888c7e-e659-11ec-b7fe-10c37b4ac2ea)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2022-29804

high

Tenable Plugins

critical

high

high

critical

critical

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high