An update of the go package has been released.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the kubernetes package has been released.

According to the versions of the golang packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection. (CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing in affected downstream applications.
    (CVE-2020-29510)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
150285	Photon OS 3.0: Go PHSA-2021-3.0-0248	Nessus	PhotonOS Local Security Checks	6/4/2021	7/24/2024	medium
148062	EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-1678)	Nessus	Huawei Local Security Checks	3/24/2021	5/10/2022	high
144686	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1006)	Nessus	Huawei Local Security Checks	1/4/2021	5/11/2022	high
204385	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0419	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
147555	EulerOS Virtualization 3.0.6.6 : golang (EulerOS-SA-2021-1480)	Nessus	Huawei Local Security Checks	3/10/2021	5/10/2022	high
144699	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1025)	Nessus	Huawei Local Security Checks	1/4/2021	5/11/2022	high
229875	Linux Distros Unpatched Vulnerability : CVE-2020-29510	Nessus	Misc.	3/5/2025	3/5/2025	medium

Detections

Analytics

Plugins Search

medium

high

high

critical

high

high

medium