The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5493 advisory.

    delve     [1.4.1-1.0.1]
    - Disable DWARF compression which has issues (Alex Burmashev)

    [1.4.1-1]
    - Rebase to 1.4.1
    - Resolves: rhbz#1821281
    - Related: rhbz#1820596

    [1.4.0-2]
    - Change i686 to a better macro
    - Related: rhbz#1820596

    [1.4.0-1]
    - Rebase to 1.4.0
    - Remove Patch1781
    - Related: rhbz#1820596

    [1.3.2-3]
    - Resolves: rhbz#1758612
    - Resolves: rhbz#1780554
    - Add patch: 1781-pkg-terminal-Fix-exit-status.patch

    [1.3.2-2]
    - Added tests
    - Related: rhbz#1758612

    [1.3.2-1]
    - First package for RHEL
    - Related: rhbz#1758612

    golang     [1.14.12-1]
    - Rebase to 1.14.12
    - Resolves: rhbz#1898829
    - Resolves: rhbz#1898832
    - Resolves: rhbz#1898834

    [1.14.10-1]
    - Rebase to 1.14.10
    - Remove patch to fix missing deferreturn on linux/ppc64le rhbz#1854836
    - Resolves: rhbz#1897181
    - Resolves: rhbz#1897182
    - Resolves: rhbz#1897185

    go-toolset     [1.14.12-1]
    - Rebase to 1.14.12
    - Resolves: rhbz#1898829
    - Resolves: rhbz#1898832
    - Resolves: rhbz#1898834

    [1.14.10-1]
    - Rebase to 1.14.10
    - Resolves: rhbz#1897181
    - Resolves: rhbz#1897182
    - Resolves: rhbz#1897185

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header. (CVE-2020-24553)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Some HTTP/2 implementations are vulnerable to ping     floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer,     causing the peer to build an internal queue of     responses. Depending on how efficiently this data is     queued, this can consume excess CPU, memory, or     both.(CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to a reset     flood, potentially leading to a denial of service. The     attacker opens a number of streams and sends an invalid     request over each stream that should solicit a stream     of RST_STREAM frames from the peer. Depending on how     the peer queues the RST_STREAM frames, this can consume     excess memory, CPU, or both.(CVE-2019-9514)

  - Go before 1.13.15 and 14.x before 1.14.7 can have an     infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs.(CVE-2020-16845)

  - Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS     because text/html is the default for CGI/FCGI handlers     that lack a Content-Type header.(CVE-2020-24553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0069 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-16276:
    Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

    CVE-2019-17596:
    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates.

    CVE-2019-6486:
    Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows     attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery     attacks.

    CVE-2019-9512:
    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

    CVE-2019-9741:
    An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP     header or a Redis command.

    CVE-2020-15586:
    Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by     the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

    CVE-2020-16845:
    Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in     encoding/binary via invalid inputs.

    CVE-2020-24553:
    Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI     handlers that lack a Content-Type header.

    CVE-2021-29923:
    Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address     octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses,     because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
144562	Oracle Linux 8 : go-toolset:ol8 (ELSA-2020-5493)	Nessus	Oracle Linux Local Security Checks	2020/12/23	2024/11/1	high
150285	Photon OS 3.0: Go PHSA-2021-3.0-0248	Nessus	PhotonOS Local Security Checks	2021/6/4	2025/8/22	medium
229896	Linux Distros Unpatched Vulnerability : CVE-2020-24553	Nessus	Misc.	2025/3/5	2025/8/18	medium
145182	EulerOS 2.0 SP3 : golang (EulerOS-SA-2021-1073)	Nessus	Huawei Local Security Checks	2021/1/20	2022/12/5	medium
236585	Alibaba Cloud Linux 3 : 0069: go-toolset:rhel8 (ALINUX3-SA-2021:0069)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	high

检测

插件搜索

high

medium

medium

medium

high