The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4212 advisory.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4237 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4212 advisory.

    - Update to Go 1.21.11 that fixes CVE-2024-24789 and CVE-2024-24790

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:4237 advisory.

    * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4237 advisory.

    - Update to Go1.21.11 to address CVE-2024-24789 and CVE-2024-24790
    - Rebase to Go1.21.11 that includes fixes for CVE-2024-24789 and CVE-2024-24790

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5291 advisory.

    * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

    * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0176 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-24789:
    The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most     zip implementations. This misalignment could be exploited to create an zip file with contents that vary     depending on the implementation reading the file. The archive/zip package now rejects files containing     these errors.

    CVE-2024-24790:
    The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6     addresses, returning false for addresses which would return true in their traditional IPv4 forms.

    CVE-2024-24791:
    The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an Expect:
    100-continue header with a non-informational (200 or higher) status. This mishandling could leave a     client connection in an invalid state, where the next request sent on the connection will fail. An     attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause     a denial of service by sending Expect: 100-continue requests which elicit a non-informational response     from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent     request using that connection to fail.

    CVE-2024-34155:
    Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a     panic due to stack exhaustion.

    CVE-2024-34156:
    Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack     exhaustion. This is a follow-up to CVE-2022-30635.

    CVE-2024-34158:
    Calling Parse on a // +build build tag line with deeply nested expressions can cause a panic due to     stack exhaustion.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3755-1 advisory.

    - CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
    - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
    - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip     (bsc#1225974)
    - CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
    - CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in     net/http and x/net/http2 (bsc#1221400)
    - CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http     and net/http/cookiejar (bsc#1221000)
    - CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
    - CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in     crypto/x509 (bsc#1220999)
    - CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
    - CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in     html/template (bsc#1221003)

    Other fixes:
    - Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
    - Update to version 1.21.13 (bsc#1212475)
    - Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
    - Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7111-1 advisory.

    Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly     use this issue to cause a denial of service. (CVE-2022-41723)

    Marten Seemann discovered that Go did not properly manage memory under certain circumstances. An attacker     could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41724)

    Ameya Darshan and Jakob Ackermann discovered that Go did not properly validate the amount of memory and     disk files ReadForm can consume. An attacker could possibly use this issue to cause a panic resulting in a     denial of service. (CVE-2022-41725)

    Jakob Ackermann discovered that Go incorrectly handled multipart forms. An attacker could possibly use     this issue to consume an excessive amount of resources, resulting in a denial of service. (CVE-2023-24536)

    It was discovered that Go did not properly validate the //go:cgo_ directives during compilation. An     attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323)

    Bartek Nowotarski was discovered that the Go net/http module did not properly handle the requests when     request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic     resulting into a denial of service. (CVE-2023-45288)

    Bartek Nowotarski discovered that the Go net/http module did not properly validate the total size of the     parsed form when parsing a multipart form. An attacker could possibly use this issue to cause a panic     resulting into a denial of service. (CVE-2023-45290)

    John Howard discovered that the Go crypto/x509 module did not properly handle a certificate chain which     contains a certificate with an unknown public key algorithm. An attacker could possibly use this issue to     cause a panic resulting into a denial of service. (CVE-2024-24783)

    Juho Nurminen discovered that the Go net/mail module did not properly handle comments within display names     in the ParseAddressList function. An attacker could possibly use this issue to cause a panic resulting     into a denial of service. (CVE-2024-24784)

    Yufan You discovered that the Go archive/zip module did not properly handle certain types of invalid zip     files differs from the behavior of most zip implementations. An attacker could possibly use this issue to     cause a panic resulting into a denial of service. (CVE-2024-24789)

    Geoff Franks discovered that the Go net/http module did not properly handle responses to requests with an     Expect: 100-continue header under certain circumstances. An attacker could possibly use this issue to     cause a denial of service. (CVE-2024-24791)

    It was discovered that the Go parser module did not properly handle deeply nested literal values. An     attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34155)

    Md Sakib Anwar discovered that the Go encoding/gob module did not properly handle message decoding under     certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of     service. (CVE-2024-34156)

    It was discovered that the Go build module did not properly handle certain build tag lines with deeply     nested expressions. An attacker could possibly use this issue to cause a panic resulting in a denial of     service. (CVE-2024-34158)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
201232	RHEL 9 : golang (RHSA-2024:4212)	Nessus	Red Hat Local Security Checks	7/2/2024	3/6/2025	critical
201290	RHEL 8 : go-toolset (RHSA-2024:4237)	Nessus	Red Hat Local Security Checks	7/2/2024	3/6/2025	critical
201311	Oracle Linux 9 : golang (ELSA-2024-4212)	Nessus	Oracle Linux Local Security Checks	7/3/2024	9/9/2025	critical
201537	AlmaLinux 8 : go-toolset (ALSA-2024:4237)	Nessus	Alma Linux Local Security Checks	7/3/2024	1/13/2025	critical
201844	Oracle Linux 8 : go-toolset (ELSA-2024-4237)	Nessus	Oracle Linux Local Security Checks	7/3/2024	9/9/2025	critical
235587	RockyLinux 8 : grafana (RLSA-2024:5291)	Nessus	Rocky Linux Local Security Checks	5/7/2025	5/7/2025	critical
235951	Alibaba Cloud Linux 3 : 0176: go-toolset:rhel8 (ALINUX3-SA-2024:0176)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical
209811	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21-openssl (SUSE-SU-2024:3755-1)	Nessus	SuSE Local Security Checks	10/27/2024	10/27/2024	critical
210583	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.22-openssl (SUSE-SU-2024:3938-1)	Nessus	SuSE Local Security Checks	11/8/2024	11/8/2024	critical
211363	Ubuntu 22.04 LTS : Go vulnerabilities (USN-7111-1)	Nessus	Ubuntu Local Security Checks	11/14/2024	11/14/2024	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

high