Detections
Analytics

openSUSE 16 Security Update : gosec (openSUSE-SU-2026:22197-1)

high Nessus Plugin ID 374774

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22197-1 advisory.

 Changes in gosec:

 - Update to version 2.30.0 (bsc#1287590, CVE-2026-97032):
 * fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
 * fix(G112): honor read timeouts assigned through a struct field (#1798)
 * fix(G112): report read timeouts explicitly set to zero (#1797)
 * feat(G706): extend log/slog method coverage (#1795)
 * fix(autofix): read the first text block of a Claude response (#1794)
 * fix(autofix): give every AI request its own timeout (#1793)
 * fix(resolve): treat constants from other packages as resolved (#1792)
 * fix(autofix): return an error when a Gemini candidate has no content (#1791)
 * Update to go version 1.27.3 and 1.26.10 (#1790)
 * fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
 * fix(G102): resolve concatenated and constant listen addresses (#1787)
 * fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786)
 * fix(g602): track statically known lengths for append results in slice bounds check (#1773)
 * feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777)
 * fix: load absolute file paths so nested modules are analysed from the parent directory (#1779)
 * fix(G118): treat a cancel sent on a channel as handed off (#1782)
 * fix(G112): honor read timeouts assigned after the http.Server literal (#1781)
 * fix(G303): resolve constant temp file paths (#1784)
 * fix(deps): update all dependencies (#1783)
 * fix(G203): treat constant template arguments as safe (#1770)
 * fix(G402): check TLS settings assigned through a *tls.Config (#1769)
 * fix(deps): update all dependencies (#1775)
 * Update to go version 1.27.2 and 1.26.9 (#1772)
 * Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767)
 * fix(G602): track append() results for slice bounds checking (#1754)
 * fix(deps): update all dependencies (#1768)
 * fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752)
 * fix(G407): treat an array IV/nonce as a zeroed buffer (#1763)
 * fix(fileperms): resolve constant file and directory permissions (#1766)
 * fix(G102): detect binding to the IPv6 unspecified address (#1760)
 * fix(G407): stop the nonce source walk on cycles (#1761)
 * fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762)
 * fix(deps): update all dependencies (#1764)
 * fix(G602): validate inequality len guards (#1757)
 * fix(G121): track request captured by closures (#1759)
 * fix(deps): update all dependencies (#1756)
 * fix: make nosec suppression independent of comment order (#1741)
 * fix(G403): resolve constant RSA key sizes (#1751)
 * fix(G602): validate subslice bounds under equality guards (#1749)
 * fix(G124): resolve negated constant cookie flags (#1748)
 * fix(G602): report constant index equal to the length asserted by an equality guard (#1746)
 * Skip taint call graphs when no sinks match (#1745)
 * Fix brittle test for html writer (#1744)
 * fix(G404): ignore non-cryptographic Shuffle calls (#1742)
 * fix(deps): update all dependencies (#1743)
 * fix(taint): remove Result.Source field that is never populated (#1739)
 * Update all dependencies (#1737)
 * Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738)
 * fix(report): correct Babel SRI hash (#1736)
 * fix(taint): make wide caller traversal deterministic (#1733)
 * fix(G702): skip the context argument of exec.CommandContext (#1730)
 * feat(taint): name the sink in taint finding messages (#1731)
 * Update all dependencies (#1734)
 * Update action to gosec version 2.29.0 (#1728)

 - Update to version 2.29.0:
 * analyzers/G703: stop treating Clean/Abs/PathEscape as path-traversal sanitizers (#1723)
 * fix(junit): properly escape XML in failure text (#1718)
 * fix(csv): capture and report write errors on flush (#1716)
 * fix(report): root path matching in formatters (#1719)
 * fix(config): handle nosec tags with leading hash (#1717)
 * Update all dependencies (#1720)
 * Add support for go version 1.27.0 and update to version 1.25.14 and 1 (#1726)
 * Update all dependencies (#1713)
 * Update all dependencies (#1710)
 * fix(G202): don't flag strings.Builder built from constants (#1707)
 * ci: allow fork PR checkout in barry-ai-security-review job (#1708)
 * Update all dependencies (#1709)
 * Downgrade min Go version (#1706)
 * Udpate action to use gosec v2.28.0 (#1705)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gosec package.

See Also

https://bugzilla.suse.com/1287590

https://www.suse.com/security/cve/CVE-2026-97032

Plugin Details

Severity: High

ID: 374774

File Name: openSUSE-2026-22197-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/1/2026

Updated: 11/1/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-97032

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:gosec

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/28/2026

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-97032