An update of the go package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5493 advisory.

    delve     [1.4.1-1.0.1]
    - Disable DWARF compression which has issues (Alex Burmashev)

    [1.4.1-1]
    - Rebase to 1.4.1
    - Resolves: rhbz#1821281
    - Related: rhbz#1820596

    [1.4.0-2]
    - Change i686 to a better macro
    - Related: rhbz#1820596

    [1.4.0-1]
    - Rebase to 1.4.0
    - Remove Patch1781
    - Related: rhbz#1820596

    [1.3.2-3]
    - Resolves: rhbz#1758612
    - Resolves: rhbz#1780554
    - Add patch: 1781-pkg-terminal-Fix-exit-status.patch

    [1.3.2-2]
    - Added tests
    - Related: rhbz#1758612

    [1.3.2-1]
    - First package for RHEL
    - Related: rhbz#1758612

    golang     [1.14.12-1]
    - Rebase to 1.14.12
    - Resolves: rhbz#1898829
    - Resolves: rhbz#1898832
    - Resolves: rhbz#1898834

    [1.14.10-1]
    - Rebase to 1.14.10
    - Remove patch to fix missing deferreturn on linux/ppc64le rhbz#1854836
    - Resolves: rhbz#1897181
    - Resolves: rhbz#1897182
    - Resolves: rhbz#1897185

    go-toolset     [1.14.12-1]
    - Rebase to 1.14.12
    - Resolves: rhbz#1898829
    - Resolves: rhbz#1898832
    - Resolves: rhbz#1898834

    [1.14.10-1]
    - Rebase to 1.14.10
    - Resolves: rhbz#1897181
    - Resolves: rhbz#1897182
    - Resolves: rhbz#1897185

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0069 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-16276:
    Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

    CVE-2019-17596:
    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates.

    CVE-2019-6486:
    Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows     attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery     attacks.

    CVE-2019-9512:
    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

    CVE-2019-9741:
    An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP     header or a Redis command.

    CVE-2020-15586:
    Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by     the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

    CVE-2020-16845:
    Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs.

    CVE-2020-24553:
    Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header.

    CVE-2021-29923:
    Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address     octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses,     because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 20.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in Oracle NoSQL Database (component: Administration (Node.js)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle NoSQL Database.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle NoSQL Database. (CVE-2021-22883)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (jackson-databind)).
    This vulnerability cannot be exploited in the context of this product. (CVE-2019-14379)

  - Vulnerability in Oracle NoSQL Database (component: Administration (Google Guava)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle NoSQL Database executes to compromise     Oracle NoSQL Database. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle NoSQL Database accessible data. (CVE-2020-8908)   
  - Vulnerability in Oracle NoSQL Database (component: Administration (Netty)). The supported version     that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle NoSQL Database. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle NoSQL Database. (CVE-2020-11612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for go1.14 fixes the following issues :

  - go1.14.9 (released 2020-09-09) includes fixes to the     compiler, linker, runtime, documentation, and the     net/http and testing packages. Refs bsc#1164903 go1.14     release tracking

  - go#41192 net/http/fcgi: race detected during execution     of TestResponseWriterSniffsContentType test

  - go#41016 net/http: Transport.CancelRequest no longer     cancels in-flight request

  - go#40973 net/http: RoundTrip unexpectedly changes     Request

  - go#40968 runtime: checkptr incorrectly -race flagging     when using &^ arithmetic

  - go#40938 cmd/compile: R12 can be clobbered for write     barrier call on PPC64

  - go#40848 testing: '=== PAUSE' lines do not change the     test name for the next log line

  - go#40797 cmd/compile: inline marker targets not     reachable after assembly on arm

  - go#40766 cmd/compile: inline marker targets not     reachable after assembly on ppc64x

  - go#40501 cmd/compile: for range loop reading past slice     end

  - go#40411 runtime: Windows service lifecycle events     behave incorrectly when called within a golang     environment

  - go#40398 runtime: fatal error: checkdead: runnable g

  - go#40192 runtime: pageAlloc.searchAddr may point to     unmapped memory in discontiguous heaps, violating its     invariant

  - go#39955 cmd/link: incorrect GC bitmap when global's     type is in another shared object

  - go#39690 cmd/compile: s390x floating point <-> integer     conversions clobbering the condition code

  - go#39279 net/http: Re-connect with upgraded HTTP2     connection fails to send Request.body

  - go#38904 doc: include fix for #34437 in Go 1.14 release     notes

  - go1.14.8 (released 2020-09-01) includes security fixes     to the net/http/cgi and net/http/fcgi packages.
    CVE-2020-24553 Refs bsc#1164903 go1.14 release tracking

  - bsc#1176031 CVE-2020-24553

  - go#41164 net/http/cgi,net/http/fcgi: Cross-Site     Scripting (XSS) when Content-Type is not specified This     update was imported from the SUSE:SLE-15:Update update     project.

The version of golang installed on the remote host is prior to 1.15.3-1.63. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1445 advisory.

    Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5493 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0145 advisory.

    Red Hat OpenShift Serverless Client kn CLI is delivered as an RPM package for installation on RHEL     platforms, and as binaries for non-Linux platforms.

    Red Hat OpenShift Serverless Client kn 1.12.0 provides a CLI to interact     with Red Hat OpenShift Serverless 1.12.0, and includes security and bug fixes and enhancements. For more     information, see the release notes listed in the References section.

    Security Fix(es):

    * golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issues and their impact, the CVSS     score, acknowledgements, and other related information, see the CVE pages     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
150285	Photon OS 3.0: Go PHSA-2021-3.0-0248	Nessus	PhotonOS Local Security Checks	6/4/2021	8/22/2025	medium
144562	Oracle Linux 8 : go-toolset:ol8 (ELSA-2020-5493)	Nessus	Oracle Linux Local Security Checks	12/23/2020	11/1/2024	high
229896	Linux Distros Unpatched Vulnerability : CVE-2020-24553	Nessus	Misc.	3/5/2025	8/4/2026	medium
236585	Alibaba Cloud Linux 3 : 0069: go-toolset:rhel8 (ALINUX3-SA-2021:0069)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/15/2025	high
148977	Oracle NoSQL Database Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	4/23/2021	10/24/2023	critical
141160	openSUSE Security Update : go1.14 (openSUSE-2020-1584)	Nessus	SuSE Local Security Checks	10/5/2020	2/16/2024	medium
142981	Amazon Linux AMI : golang (ALAS-2020-1445)	Nessus	Amazon Linux Local Security Checks	11/18/2020	12/11/2024	medium
144407	RHEL 8 : go-toolset:rhel8 (RHSA-2020:5493)	Nessus	Red Hat Local Security Checks	12/18/2020	3/20/2025	high
210543	RHEL 8 : Red Hat OpenShift Serverless Client kn 1.12.0 (Moderate) (RHSA-2021:0145)	Nessus	Red Hat Local Security Checks	11/7/2024	11/7/2024	high

Detections

Analytics

Plugins Search

medium

high

medium

high

critical

medium

medium

high

high