According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0145 advisory.

    Red Hat OpenShift Serverless Client kn CLI is delivered as an RPM package for installation on RHEL     platforms, and as binaries for non-Linux platforms.

    Red Hat OpenShift Serverless Client kn 1.12.0 provides a CLI to interact     with Red Hat OpenShift Serverless 1.12.0, and includes security and bug fixes and enhancements. For more     information, see the release notes listed in the References section.

    Security Fix(es):

    * golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issues and their impact, the CVSS     score, acknowledgements, and other related information, see the CVE pages     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution     at build time via a malicious unquoted symbol name in a linked object file. (CVE-2020-28366)

Note that Nessus relies on the presence of the package as reported by the vendor.

- Rebase to go1.15.5

  - Security fix for CVE-2020-28362, CVE-2020-28367 and     CVE-2020-28366

----

  - Rebase to go1.15.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5333 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The version of golang installed on the remote host is prior to 1.15.5-1.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1471 advisory.

    Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

    Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. (CVE-2020-28366)

    Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. (CVE-2020-28367)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. (CVE-2020-28366)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145749	EulerOS 2.0 SP8 : golang (EulerOS-SA-2021-1144)	Nessus	Huawei Local Security Checks	2021/2/1	2024/1/25	high
148062	EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-1678)	Nessus	Huawei Local Security Checks	2021/3/24	2022/5/10	high
210543	RHEL 8 : Red Hat OpenShift Serverless Client kn 1.12.0 (Moderate) (RHSA-2021:0145)	Nessus	Red Hat Local Security Checks	2024/11/7	2024/11/7	high
250964	Linux Distros Unpatched Vulnerability : CVE-2020-28366	Nessus	Misc.	2025/8/18	2025/8/18	high
143188	Fedora 33 : golang (2020-864922e78a)	Nessus	Fedora Local Security Checks	2020/11/23	2021/7/6	high
143469	RHEL 7 : go-toolset-1.14-golang (RHSA-2020:5333)	Nessus	Red Hat Local Security Checks	2020/12/3	2024/11/7	high
144064	Photon OS 3.0: Go PHSA-2020-3.0-0173	Nessus	PhotonOS Local Security Checks	2020/12/10	2025/8/22	high
144999	Amazon Linux AMI : golang (ALAS-2021-1471)	Nessus	Amazon Linux Local Security Checks	2021/1/14	2024/12/11	high
154361	EulerOS 2.0 SP3 : golang (EulerOS-SA-2021-2582)	Nessus	Huawei Local Security Checks	2021/10/25	2021/10/25	high

检测

插件搜索

high

high

high

high

high

high

high

high

high