According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5493 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Rebase to go1.14.13

  - Security fix for CVE-2020-28362, CVE-2020-28367 and     CVE-2020-28366

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.14 fixes the following issues :

  - go1.14.12 (released 2020-11-12) includes security fixes     to the cmd/go and math/big packages.

  - go#42553 math/big: panic during recursive division of     very large numbers (bsc#1178750 CVE-2020-28362)

  - go#42560 cmd/go: arbitrary code can be injected into cgo     generated files (bsc#1178752 CVE-2020-28367)

  - go#42557 cmd/go: improper validation of cgo flags can     lead to remote code execution at build time (bsc#1178753     CVE-2020-28366)

  - go#42155 time: Location interprets wrong timezone (DST)     with slim zoneinfo

  - go#42112 x/net/http2: the first write error on a     connection will cause all subsequent write requests to     fail blindly

  - go#41991 runtime: macOS-only segfault on 1.14+ with     'split stack overflow'

  - go#41913 net/http: request.Clone doesn't deep copy     TransferEncoding

  - go#41703 runtime: macOS syscall.Exec can get SIGILL due     to preemption signal

  - go#41386 x/net/http2: connection-level flow control not     returned if stream errors, causes server hang

This update was imported from the SUSE:SLE-15:Update update project.

An update of the go package has been released.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.15 fixes the following issues :

  - go1.15.5 (released 2020-11-12) includes security fixes     to the cmd/go and math/big packages.

  - go#42553 math/big: panic during recursive division of     very large numbers (bsc#1178750 CVE-2020-28362)

  - go#42560 cmd/go: arbitrary code can be injected into cgo     generated files (bsc#1178752 CVE-2020-28367)

  - go#42557 cmd/go: improper validation of cgo flags can     lead to remote code execution at build time (bsc#1178753     CVE-2020-28366)

  - go#42169 cmd/compile, runtime, reflect: pointers to     go:notinheap types must be stored indirectly in     interfaces

  - go#42151 cmd/cgo: opaque struct pointers are broken     since Go 1.15.3

  - go#42138 time: Location interprets wrong timezone (DST)     with slim zoneinfo

  - go#42113 x/net/http2: the first write error on a     connection will cause all subsequent write requests to     fail blindly

  - go#41914 net/http: request.Clone doesn't deep copy     TransferEncoding

  - go#41704 runtime: macOS syscall.Exec can get SIGILL due     to preemption signal

  - go#41463 compress/flate: deflatefast produces corrupted     output

  - go#41387 x/net/http2: connection-level flow control not     returned if stream errors, causes server hang

  - go#40974 cmd/link: sectionForAddress(0xA9D67F) address     not in any section file

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5333 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.15.5-1.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1471 advisory.

    Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

    Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. (CVE-2020-28366)

    Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. (CVE-2020-28367)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144699	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1025)	Nessus	Huawei Local Security Checks	1/4/2021	5/11/2022	high
144407	RHEL 8 : go-toolset:rhel8 (RHSA-2020:5493)	Nessus	Red Hat Local Security Checks	12/18/2020	3/20/2025	high
144315	Fedora 32 : golang (2020-e971480183)	Nessus	Fedora Local Security Checks	12/16/2020	7/6/2021	high
143337	openSUSE Security Update : go1.14 (openSUSE-2020-2047)	Nessus	SuSE Local Security Checks	11/30/2020	7/6/2021	high
144064	Photon OS 3.0: Go PHSA-2020-3.0-0173	Nessus	PhotonOS Local Security Checks	12/10/2020	8/22/2025	high
145749	EulerOS 2.0 SP8 : golang (EulerOS-SA-2021-1144)	Nessus	Huawei Local Security Checks	2/1/2021	1/25/2024	high
143457	openSUSE Security Update : go1.15 (openSUSE-2020-2139)	Nessus	SuSE Local Security Checks	12/3/2020	7/6/2021	high
143469	RHEL 7 : go-toolset-1.14-golang (RHSA-2020:5333)	Nessus	Red Hat Local Security Checks	12/3/2020	11/7/2024	high
144999	Amazon Linux AMI : golang (ALAS-2021-1471)	Nessus	Amazon Linux Local Security Checks	1/14/2021	12/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high