An update of the go package has been released.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.0. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2022:7399

    Security Fix(es):

    * go-yaml: Denial of Service in go-yaml (CVE-2021-4235)
    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
    * kubernetes: Unauthorized read of Custom Resources (CVE-2022-3162)
    * kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)
    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
    * cri-o: incorrect handling of the supplementary groups (CVE-2022-2995)
    * OpenShift: Missing HTTP Strict Transport Security (CVE-2022-3259)
    * cri-o: Security regression of CVE-2022-27652 (CVE-2022-3466)
    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-26 (Go: Multiple Vulnerabilities)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example,     JoinPath(https://go.dev, ../go) returns the URL https://go.dev/../go, despite the JoinPath     documentation stating that ../ path elements are removed from the result. (CVE-2022-32190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory.

  - go-yaml: Denial of Service in go-yaml (CVE-2021-4235)

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers     (CVE-2022-2879)

  - golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

  - cri-o: incorrect handling of the supplementary groups (CVE-2022-2995)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3204 advisory.

    OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container     Platform.

    This advisory contains OpenShift Virtualization 4.13.0 RPMs.

    Security Fix(es):

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags     (CVE-2022-32149)

    * golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * 4.13.0 rpms (BZ#2124993)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3613 advisory.

  - golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers     (CVE-2022-2879)

  - golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

  - golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

  - golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags     (CVE-2022-32149)

  - golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
333727	Photon OS 5.0: Go PHSA-2026-5.0-91-0869	Nessus	PhotonOS Local Security Checks	8/10/2026	8/12/2026	medium
194196	RHEL 8 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)	Nessus	Red Hat Local Security Checks	4/28/2024	3/16/2026	high
165543	GLSA-202209-26 : Go: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	9/29/2022	10/10/2023	high
189448	RHCOS 4 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)	Nessus	Red Hat Local Security Checks	1/24/2024	5/4/2026	critical
194320	RHEL 7 / 8 / 9 : OpenShift Virtualization 4.13.0 RPMs (RHSA-2023:3204)	Nessus	Red Hat Local Security Checks	4/28/2024	11/7/2024	high
189414	RHCOS 4 : OpenShift Container Platform 4.12.22 (RHSA-2023:3613)	Nessus	Red Hat Local Security Checks	1/24/2024	5/4/2026	high

Detections

Analytics

Plugins Search

medium

high

high

critical

high

high