openSUSE Security Update : go1.14 (openSUSE-2020-1405)

medium Nessus Plugin ID 140569
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for go1.14 fixes the following issues :

- go1.14 was updated to version 1.14.7

- CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).	

- go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

- go#39991 runtime: missing deferreturn on linux/ppc64le

- go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent

- go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes

- go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15

- go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally

- go#39636 reflect: DeepEqual can return true for values that are not equal

- go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues

- go#39562 cmd/compile/internal/ssa:
TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64

- go#39308 testing: streaming output loses parallel subtest associations

- go#39288 cmd/vet: update for new number formats

- go#39101 database/sql: context cancellation allows statements to execute after rollback

- go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes

- go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586

- go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

- Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

Solution

Update the affected go1.14 packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1164903

https://bugzilla.opensuse.org/show_bug.cgi?id=1169832

https://bugzilla.opensuse.org/show_bug.cgi?id=1170826

https://bugzilla.opensuse.org/show_bug.cgi?id=1172868

https://bugzilla.opensuse.org/show_bug.cgi?id=1174153

https://bugzilla.opensuse.org/show_bug.cgi?id=1174191

https://bugzilla.opensuse.org/show_bug.cgi?id=1174977

Plugin Details

Severity: Medium

ID: 140569

File Name: openSUSE-2020-1405.nasl

Version: 1.4

Type: local

Agent: unix

Published: 9/14/2020

Updated: 12/4/2020

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2020-14039

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:go1.14, p-cpe:/a:novell:opensuse:go1.14-race, cpe:/o:novell:opensuse:15.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 9/10/2020

Vulnerability Publication Date: 7/17/2020

Reference Information

CVE: CVE-2020-14039, CVE-2020-15586, CVE-2020-16845

IAVB: 2020-B-0060-S