A vulnerability was discovered in the implementation of the P-521 and P-384 elliptic curves, which could result in denial of service and in some cases key recovery.

In addition this update fixes a vulnerability in 'go get', which could result in the execution of arbitrary shell commands.

Security fix for CVE-2019-6486

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Go mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.(CVE-2019-6486)

Note: This CVE is also fixed in golang-1.11.3-2.amzn2.0.2 in the golang1.11 extras repository.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-4550 advisory.

    - apply fix for runc CVE-2019-5736

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has docker-image-check packages installed that are affected by multiple vulnerabilities:

  - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a hostname of google.com. (CVE-2019-14809)

  - The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work     performed for each chain verification, which might allow attackers to craft pathological inputs leading to     a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
    (CVE-2018-16875)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. (CVE-2019-16276)

  - Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows     attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery     attacks. (CVE-2019-6486)

  - Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs. (CVE-2020-16845)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

A vulnerability was discovered in the implementation of the P-521 and P-384 elliptic curves, which could result in denial of service and in some cases key recovery.

In addition this update fixes two vulnerabilities in 'go get', which could result in the execution of arbitrary shell commands.

It was discovered that there was a denial of service vulnerability or possibly even the ability to conduct private key recovery attacks within in the elliptic curve cryptography handling in the Go programming language libraries.

For Debian 8 'Jessie', this issue has been fixed in golang version 2:1.3.3-1+deb8u1.

We recommend that you upgrade your golang packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.11 to version 1.11.5 fixes the following issues :

Security issue fixed :

CVE-2019-6486: Fixed a CPU Denial-of-Service vulnerability affecting crypto/ellpitic related to P-521 and P-384 (bsc#1123013 go#29903).

Other bug fixes and changes made: Fix erroneous trailing backslash in %post script.

Use better forms of -exec \; in some places.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows     attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery     attacks. (CVE-2019-6486)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.06, has ipv6nat packages installed that are affected by multiple vulnerabilities:

  - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a hostname of google.com. (CVE-2019-14809)

  - The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work     performed for each chain verification, which might allow attackers to craft pathological inputs leading to     a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
    (CVE-2018-16875)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. (CVE-2019-16276)

  - Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows     attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery     attacks. (CVE-2019-6486)

  - Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs. (CVE-2020-16845)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Go mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks. (CVE-2019-6486)

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues :

Security issues fixed :

  - CVE-2019-5736: containerd: Fixing container breakout     vulnerability (bsc#1121967).

  - CVE-2019-6486: go security release, fixing     crypto/elliptic CPU DoS vulnerability affecting P-521     and P-384 (bsc#1123013).

  - CVE-2018-16873: go secuirty release, fixing cmd/go     remote command execution (bsc#1118897).

  - CVE-2018-16874: go security release, fixing cmd/go     directory traversal (bsc#1118898).

  - CVE-2018-16875: go security release, fixing crypto/x509     CPU denial of service (bsc#1118899).

Other changes and bug fixes :

  - Update to containerd v1.2.5, which is required for     v18.09.5-ce (bsc#1128376, bsc#1134068).

  - Update to runc 2b18fe1d885e, which is required for     Docker v18.09.5-ce (bsc#1128376, bsc#1134068).

  - Update to Docker 18.09.5-ce see upstream changelog in     the packaged (bsc#1128376, bsc#1134068).

  - docker-test: Improvements to test packaging     (bsc#1128746).

  - Move daemon.json file to /etc/docker directory     (bsc#1114832).

  - Revert golang(API) removal since it turns out this     breaks >= requires in certain cases (bsc#1114209).

  - Fix go build failures (bsc#1121397).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4546 advisory.

    - CVE-2019-6486
    - [CVE-2018-1002105] Handle error responses from backends
    - Ensure that the runtime mounts RO volumes read-only [CVE-2017-1002102]
    - Update Dashboard version to v1.8.3 [CVE-2017-1002102]
    - Fix nested volume mounts for read-only API data volumes [CVE-2017-1002102]
    - Add feature gate for subpath [CVE-2017-1002101]
    - Add subpath e2e tests [CVE-2017-1002101]
    - Lock subPath volumes [CVE-2017-1002101]
    - CVE-2019-6486
    - CVE-2019-6486

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-4551 advisory.

    - update runc for CVE-2019-5736

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0069 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-16276:
    Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

    CVE-2019-17596:
    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates.

    CVE-2019-6486:
    Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows     attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery     attacks.

    CVE-2019-9512:
    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

    CVE-2019-9741:
    An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP     header or a Redis command.

    CVE-2020-15586:
    Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by     the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

    CVE-2020-16845:
    Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs.

    CVE-2020-24553:
    Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header.

    CVE-2021-29923:
    Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address     octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses,     because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has ipv6nat-selinux packages installed that are affected by multiple vulnerabilities:

  - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a hostname of google.com. (CVE-2019-14809)

  - The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work     performed for each chain verification, which might allow attackers to craft pathological inputs leading to     a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
    (CVE-2018-16875)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. (CVE-2019-16276)

  - Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows     attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery     attacks. (CVE-2019-6486)

  - Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs. (CVE-2020-16845)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
121557	Debian DSA-4379-1 : golang-1.7 - security update	Nessus	Debian Local Security Checks	2019/2/4	2024/6/24	high
121582	Fedora 29 : golang (2019-dbd82d0882)	Nessus	Fedora Local Security Checks	2019/2/5	2024/6/24	high
122678	Amazon Linux 2 : golang (ALAS-2019-1172)	Nessus	Amazon Linux Local Security Checks	2019/3/8	2024/6/14	high
180741	Oracle Linux 7 : docker-engine (ELSA-2019-4550)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	high
330494	NewStart CGSL MAIN 6.06 : docker-image-check Multiple Vulnerabilities (NS-SA-2026-0055)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/29	critical
126193	Photon OS 3.0: Go PHSA-2019-3.0-0019	Nessus	PhotonOS Local Security Checks	2019/6/25	2025/8/22	high
121558	Debian DSA-4380-1 : golang-1.8 - security update	Nessus	Debian Local Security Checks	2019/2/4	2024/6/24	high
121626	Debian DLA-1664-1 : golang security update	Nessus	Debian Local Security Checks	2019/2/7	2024/6/24	high
122970	SUSE SLED15 / SLES15 Security Update : go1.11 (SUSE-SU-2019:0651-1)	Nessus	SuSE Local Security Checks	2019/3/20	2024/6/13	high
222884	Linux Distros Unpatched Vulnerability : CVE-2019-6486	Nessus	Misc.	2025/3/4	2025/9/14	high
330491	NewStart CGSL MAIN 6.06 : ipv6nat Multiple Vulnerabilities (NS-SA-2026-0062)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/29	critical
122760	Amazon Linux AMI : golang (ALAS-2019-1172)	Nessus	Amazon Linux Local Security Checks	2019/3/12	2024/6/14	high
125697	openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2019-1499)	Nessus	SuSE Local Security Checks	2019/6/4	2024/5/17	high
180712	Oracle Linux 7 : kubernetes (ELSA-2019-4546)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	high
180638	Oracle Linux 7 : docker-engine (ELSA-2019-4551)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	high
236585	Alibaba Cloud Linux 3 : 0069: go-toolset:rhel8 (ALINUX3-SA-2021:0069)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	high
330499	NewStart CGSL MAIN 6.06 : ipv6nat-selinux Multiple Vulnerabilities (NS-SA-2026-0054)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/29	critical

检测

插件搜索

high

high

high

high

critical

high

high

high

high

high

critical

high

high

high

high

high

critical