The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3914 advisory.

  - golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString     (CVE-2022-23772)

  - golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)

  - golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)

  - golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)

  - golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

  - openshift: OCP & FIPS mode (CVE-2023-3089)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - golang: arbitrary command execution via VCS path (CVE-2018-7187)

  - golang: Command-line arguments may overwrite global data (CVE-2021-38297)

  - On Darwin, user's trust preferences for root certificates were not honored. If the user had a root     certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a     connection using that root certificate. (CVE-2017-1000097)

  - In Go before 1.10.6 and 1.11.x before 1.11.3, the go get command is vulnerable to directory traversal     when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}'     characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction     is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary     filesystem write, which can lead to code execution. (CVE-2018-16874)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates. (CVE-2019-17596)

  - An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP     header or a Redis command. (CVE-2019-9741)

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by     the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
    (CVE-2020-15586)

  - Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs. (CVE-2020-16845)

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

  - Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

  - Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution     at build time via a malicious unquoted symbol name in a linked object file. (CVE-2020-28366)

  - Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution     at build time via malicious gcc flags specified via a #cgo directive. (CVE-2020-28367)

  - A nil pointer dereference in the golang.org/x/crypto/ssh component through     v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH     servers. (CVE-2020-29652)

  - encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader     (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode,     DecodeElement, or Skip method. (CVE-2021-27918)

  - Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address     octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses,     because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR. (CVE-2021-29923)

  - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
    (CVE-2021-3114)

  - Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code     execution when using the go get command to fetch modules that make use of cgo (for example, cgo can     execute a gcc program from an untrusted download). (CVE-2021-3115)

  - net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations. (CVE-2021-31525)

  - golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service     (infinite loop) via crafted ParseFragment input. (CVE-2021-33194)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic. (CVE-2021-33196)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

  - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil     ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

  - golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during     BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be     used as a vector for a denial-of-service attack. (CVE-2021-38561)

  - In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating     that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of     an incomplete fix for CVE-2021-33196. (CVE-2021-39293)

  - ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
    (CVE-2021-41771)

  - Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or     unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-     descriptor exhaustion. (CVE-2021-44717)

  - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

  - Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

  - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount     of PEM data. (CVE-2022-24675)

  - regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested     expression. (CVE-2022-24921)

  - The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic     via long scalar input. (CVE-2022-28327)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
193590	RHEL 8 : Red Hat OpenShift Enterprise (RHSA-2023:3914)	Nessus	Red Hat Local Security Checks	4/19/2024	4/19/2024	critical
195780	RHEL 7 : golang (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical

Detections

Analytics

Plugins Search

critical

critical