This update for go1.12 fixes the following issues :

Security issues fixed :

CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).

CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).

CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).

Bugfixes: Update to go version 1.12.9 (bsc#1141689).

Adding Web Assembly stuff from misc/wasm (bsc#1139210).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com. (CVE-2019-14809)

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.(CVE-2019-9512)

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

This update for go1.11 fixes the following issues :

Security issues fixed :

  - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that     results in unbounded memory growth (bsc#1146111).

  - CVE-2019-9514: Fixed HTTP/2 implementation that is     vulnerable to a reset flood, potentially leading to a     denial of service (bsc#1146115).

  - CVE-2019-14809: Fixed malformed hosts in URLs that leads     to authorization bypass (bsc#1146123).

Bugfixes :

  - Update to go version 1.11.13 (bsc#1141688).

This update was imported from the SUSE:SLE-15:Update update project.

- Rebase to go1.11.13

  - Security fix for CVE-2019-9512, CVE-2019-9514 and     CVE-2019-14809

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.12 fixes the following issues :

Security issues fixed :

  - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that     results in unbounded memory growth (bsc#1146111).

  - CVE-2019-9514: Fixed HTTP/2 implementation that is     vulnerable to a reset flood, potentially leading to a     denial of service (bsc#1146115).

  - CVE-2019-14809: Fixed malformed hosts in URLs that leads     to authorization bypass (bsc#1146123).

Bugfixes :

  - Update to go version 1.12.9 (bsc#1141689).

  - Adding Web Assembly stuff from misc/wasm (bsc#1139210).

This update was imported from the SUSE:SLE-15:Update update project.

An update of the go package has been released.

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.(CVE-2019-14809)

According to the version of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - net/url in Go before 1.11.13 and 1.12.x before 1.12.8     mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is     related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a     non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a     hostname of google.com.(CVE-2019-14809)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
128147	SUSE SLED15 / SLES15 Security Update : go1.12 (SUSE-SU-2019:2214-1) (Ping Flood) (Reset Flood)	Nessus	SuSE Local Security Checks	2019/8/26	2024/5/1	critical
128293	Amazon Linux AMI : golang (ALAS-2019-1270) (Ping Flood) (Reset Flood)	Nessus	Amazon Linux Local Security Checks	2019/8/28	2024/5/1	critical
128541	openSUSE Security Update : go1.11 (openSUSE-2019-2072) (Ping Flood) (Reset Flood)	Nessus	SuSE Local Security Checks	2019/9/6	2024/4/29	critical
128571	Fedora 29 : golang (2019-65db7ad6c7) (Ping Flood) (Reset Flood)	Nessus	Fedora Local Security Checks	2019/9/9	2024/4/26	critical
128863	openSUSE Security Update : go1.12 (openSUSE-2019-2130) (Ping Flood) (Reset Flood)	Nessus	SuSE Local Security Checks	2019/9/16	2024/4/25	critical
129678	Photon OS 3.0: Go PHSA-2019-3.0-0028	Nessus	PhotonOS Local Security Checks	2019/10/7	2025/8/22	critical
129791	Amazon Linux 2 : golang (ALAS-2019-1309)	Nessus	Amazon Linux Local Security Checks	2019/10/11	2024/4/18	critical
149166	EulerOS 2.0 SP3 : golang (EulerOS-SA-2021-1792)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/2	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical