The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-275:01 advisory.

    golang: HTTP/1.1 headers with a space before the colon leads to filter     bypass or request smuggling (CVE-2019-16276)         golang: invalid public key causes panic in dsa.Verify (CVE-2019-17596)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for go1.12 fixes the following issues :

Security issues fixed :

CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).

CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).

Non-security issue fixed: Go was updated to version 1.12.12 (bsc#1141689).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of golang installed on the remote host is prior to 1.13.4-1.57. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1938 advisory.

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates. (CVE-2019-17596)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service (DoS), bypasss access control, and execute arbitrary code on the developer's computer.

CVE-2017-15041

Go allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.'

CVE-2018-16873

The 'go get' command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, as it may treat the parent directory as a Git repository root, containing malicious configuration.

CVE-2018-16874

The 'go get' command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CVE-2019-9741

In net/http, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVE-2019-16276

Go allows HTTP Request Smuggling.

CVE-2019-17596

Go can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVE-2021-3114

crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

For Debian 9 stretch, these problems have been fixed in version 1.7.4-2+deb9u3.

We recommend that you upgrade your golang-1.7 packages.

For the detailed security status of golang-1.7 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.7

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of golang installed on the remote host is prior to 1.13.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2545 advisory.

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates. (CVE-2019-17596)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Rebase to go1.12.13

----

  - Rebase to 1.12.12

  - Security fix for CVE-2019-17596

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.12 fixes the following issues :

Security issues fixed :

  - CVE-2019-16276: Fixed the handling of invalid HTTP     headers, which had allowed request smuggling     (bsc#1152082).

  - CVE-2019-17596: Fixed a panic in dsa.Verify caused by     invalid public keys (bsc#1154402).

Non-security issue fixed :

  - Go was updated to version 1.12.12 (bsc#1141689).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0101 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    The following packages have been upgraded to a later upstream version: go-toolset-1.12-golang (1.12.12).
    (BZ#1759840, BZ#1785389)

    Security Fix(es):

    * golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling     (CVE-2019-16276)

    * golang: invalid public key causes panic in dsa.Verify (CVE-2019-17596)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data     race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a     request body and writes a response at the same     time.(CVE-2020-15586)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP     Request Smuggling.(CVE-2019-16276)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic     upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack     scenarios, such as traffic from a client to a server     that verifies client certificates.(CVE-2019-17596)

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the     crypto/cryptobyte package before     0.0.0-20200124225646-8b5121be2f68 for Go) allows     attacks on clients (resulting in a panic) via a     malformed X.509 certificate.(CVE-2020-7919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0329 advisory.

  - golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling     (CVE-2019-16276)

  - golang: invalid public key causes panic in dsa.Verify (CVE-2019-17596)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service (DoS), bypasss access control, and execute arbitrary code on the developer's computer.

CVE-2017-15041

Go allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.'

CVE-2018-16873

The 'go get' command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, as it may treat the parent directory as a Git repository root, containing malicious configuration.

CVE-2018-16874

The 'go get' command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CVE-2019-9741

In net/http, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVE-2019-16276

Go allows HTTP Request Smuggling.

CVE-2019-17596

Go can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVE-2021-3114

crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

For Debian 9 stretch, these problems have been fixed in version 1.8.1-1+deb9u3.

We recommend that you upgrade your golang-1.8 packages.

For the detailed security status of golang-1.8 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.8

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
294061	MiracleLinux 8 : go-toolset:rhel8 (AXSA:2020-275:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
130900	SUSE SLED15 / SLES15 Security Update : go1.12 (SUSE-SU-2019:2940-1)	Nessus	SuSE Local Security Checks	2019/11/12	2024/4/11	high
196928	Amazon Linux AMI : golang (ALAS-2024-1938)	Nessus	Amazon Linux Local Security Checks	2024/5/13	2024/12/11	high
147797	Debian DLA-2591-1 : golang-1.7 security update	Nessus	Debian Local Security Checks	2021/3/15	2024/1/12	critical
197112	Amazon Linux 2 : golang, --advisory ALAS2-2024-2545 (ALAS-2024-2545)	Nessus	Amazon Linux Local Security Checks	2024/5/15	2025/9/26	high
130782	Fedora 30 : golang (2019-34e097c66c)	Nessus	Fedora Local Security Checks	2019/11/12	2024/4/12	high
131117	openSUSE Security Update : go1.12 (openSUSE-2019-2522)	Nessus	SuSE Local Security Checks	2019/11/18	2024/4/11	high
132948	RHEL 7 : go-toolset-1.12-golang (RHSA-2020:0101)	Nessus	Red Hat Local Security Checks	2020/1/16	2024/11/7	high
139134	EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-1804)	Nessus	Huawei Local Security Checks	2020/7/30	2024/2/27	high
145950	CentOS 8 : go-toolset:rhel8 (CESA-2020:0329)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high
147800	Debian DLA-2592-1 : golang-1.8 security update	Nessus	Debian Local Security Checks	2021/3/15	2024/1/12	critical

检测

插件搜索

high

high

high

critical

high

high

high

high

high

high

critical