This update for go1.9 fixes the following issues :

Security issues fixed :

  - CVE-2018-7187: arbitrary command execution via VCS path     (boo#1081495)

Non-security changes :

  - Update to version 1.9.7

  - fixes to the go command and compiler

  - minimal support to the go command for the vgo transition

Arbitrary code execution during 'go get' via C compiler options :

An arbitrary command execution flaw was found in the way Go's 'go get' command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side. (CVE-2018-6574)

The 'go get' implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for '://' anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted website. (CVE-2018-7187)

This update for containerd, docker and go fixes the following issues :

containerd and docker :

Add backport for building containerd (bsc#1102522, bsc#1113313)

Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. (bsc#1102522)

Enable seccomp support on SLE12 (fate#325877)

Update to containerd v1.1.1, which is the required version for the Docker v18.06.0-ce upgrade. (bsc#1102522)

Put containerd under the podruntime slice (bsc#1086185)

3rd party registries used the default Docker certificate (bsc#1084533)

Handle build breakage due to missing 'export GOPATH' (caused by resolution of boo#1119634). I believe Docker is one of the only packages with this problem.

go: golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187)

Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (boo#1119634)

Fix a regression that broke go get for import path patterns containing '...' (bsc#1119706)

Additionally, the package go1.10 has been added.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an arbitrary command execution vulnerability in the Go programming language.

The 'go get' implementation did not correctly validate 'import path' statements for '://' which allowed remote attackers to execute arbitrary OS commands via a crafted website.

For Debian 7 'Wheezy', this issue has been fixed in golang version 2:1.0.2-1.1+deb7u3.

We recommend that you upgrade your golang packages. The Debian LTS team would like to thank Abhijith PA for preparing this update.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-7187

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for containerd, docker and go fixes the following issues :

containerd and docker :

  - Add backport for building containerd (bsc#1102522,     bsc#1113313)

  - Upgrade to containerd v1.1.2, which is required for     Docker v18.06.1-ce. (bsc#1102522)

  - Enable seccomp support (fate#325877)

  - Update to containerd v1.1.1, which is the required     version for the Docker v18.06.0-ce upgrade.
    (bsc#1102522)

  - Put containerd under the podruntime slice (bsc#1086185) 

  - 3rd party registries used the default Docker certificate     (bsc#1084533)

  - Handle build breakage due to missing 'export GOPATH'     (caused by resolution of boo#1119634). I believe Docker     is one of the only packages with this problem.

go :

  - golang: arbitrary command execution via VCS path     (bsc#1081495, CVE-2018-7187)

  - Make profile.d/go.sh no longer set GOROOT=, in order to     make switching between versions no longer break. This     ends up removing the need for go.sh entirely (because     GOPATH is also set automatically) (boo#1119634)

  - Fix a regression that broke go get for import path     patterns containing '...' (bsc#1119706)

Additionally, the package go1.10 has been added.

This update was imported from the SUSE:SLE-15:Update update project.

An update of the go package has been released.

The remote host is affected by the vulnerability described in GLSA-201804-12 (Go: Arbitrary code execution)

    A vulnerability in Go was discovered which does not validate the import       path of remote repositories.
  Impact :

    Remote attackers, by enticing a user to import from a crafted website,       could execute arbitrary commands.
  Workaround :

    There is no known workaround at this time.

A vulnerability was discovered in the implementation of the P-521 and P-384 elliptic curves, which could result in denial of service and in some cases key recovery.

In addition this update fixes a vulnerability in 'go get', which could result in the execution of arbitrary shell commands.

A vulnerability was discovered in the implementation of the P-521 and P-384 elliptic curves, which could result in denial of service and in some cases key recovery.

In addition this update fixes two vulnerabilities in 'go get', which could result in the execution of arbitrary shell commands.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - golang: arbitrary command execution via VCS path (CVE-2018-7187)

  - golang: Command-line arguments may overwrite global data (CVE-2021-38297)

  - On Darwin, user's trust preferences for root certificates were not honored. If the user had a root     certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a     connection using that root certificate. (CVE-2017-1000097)

  - In Go before 1.10.6 and 1.11.x before 1.11.3, the go get command is vulnerable to directory traversal     when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}'     characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction     is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary     filesystem write, which can lead to code execution. (CVE-2018-16874)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates. (CVE-2019-17596)

  - An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP     header or a Redis command. (CVE-2019-9741)

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by     the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
    (CVE-2020-15586)

  - Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs. (CVE-2020-16845)

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

  - Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

  - Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution     at build time via a malicious unquoted symbol name in a linked object file. (CVE-2020-28366)

  - Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution     at build time via malicious gcc flags specified via a #cgo directive. (CVE-2020-28367)

  - A nil pointer dereference in the golang.org/x/crypto/ssh component through     v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH     servers. (CVE-2020-29652)

  - encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader     (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode,     DecodeElement, or Skip method. (CVE-2021-27918)

  - Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address     octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses,     because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR. (CVE-2021-29923)

  - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
    (CVE-2021-3114)

  - Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code     execution when using the go get command to fetch modules that make use of cgo (for example, cgo can     execute a gcc program from an untrusted download). (CVE-2021-3115)

  - net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations. (CVE-2021-31525)

  - golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service     (infinite loop) via crafted ParseFragment input. (CVE-2021-33194)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic. (CVE-2021-33196)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

  - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil     ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

  - golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during     BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be     used as a vector for a denial-of-service attack. (CVE-2021-38561)

  - In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating     that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of     an incomplete fix for CVE-2021-33196. (CVE-2021-39293)

  - ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
    (CVE-2021-41771)

  - Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or     unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-     descriptor exhaustion. (CVE-2021-44717)

  - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

  - Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

  - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount     of PEM data. (CVE-2022-24675)

  - regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested     expression. (CVE-2022-24921)

  - The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic     via long scalar input. (CVE-2022-28327)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
123200	openSUSE Security Update : go1.9 (openSUSE-2019-482)	Nessus	SuSE Local Security Checks	3/27/2019	1/19/2021	high
108600	Amazon Linux AMI : golang (ALAS-2018-975)	Nessus	Amazon Linux Local Security Checks	3/27/2018	3/4/2019	high
120195	SUSE SLED15 / SLES15 Security Update : containerd, docker / go (SUSE-SU-2018:4297-1)	Nessus	SuSE Local Security Checks	1/2/2019	1/13/2021	high
106985	Debian DLA-1294-1 : golang security update	Nessus	Debian Local Security Checks	2/26/2018	1/11/2021	high
120938	Fedora 28 : golang (2018-fe65c14082)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	high
119952	openSUSE Security Update : containerd / docker and go (openSUSE-2018-1626)	Nessus	SuSE Local Security Checks	12/31/2018	1/19/2021	high
121818	Photon OS 1.0: Go PHSA-2018-1.0-0123	Nessus	PhotonOS Local Security Checks	2/7/2019	2/7/2019	high
123165	openSUSE Security Update : containerd / docker and go (openSUSE-2019-1044)	Nessus	SuSE Local Security Checks	3/27/2019	1/19/2021	high
110681	openSUSE Security Update : go1.9 (openSUSE-2018-672)	Nessus	SuSE Local Security Checks	6/25/2018	1/19/2021	high
109056	GLSA-201804-12 : Go: Arbitrary code execution	Nessus	Gentoo Local Security Checks	4/16/2018	6/7/2018	high
121932	Photon OS 2.0: Go PHSA-2018-2.0-0034	Nessus	PhotonOS Local Security Checks	2/7/2019	2/7/2019	high
121557	Debian DSA-4379-1 : golang-1.7 - security update	Nessus	Debian Local Security Checks	2/4/2019	2/20/2020	high
121558	Debian DSA-4380-1 : golang-1.8 - security update	Nessus	Debian Local Security Checks	2/4/2019	2/20/2020	high
195780	RHEL 7 : golang (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high

critical