リモート Azure Linux 3.0 ホストにインストールされている golang/python-tensorboard のバージョンは、テスト済みのバージョンより前です。したがって、CVE-2020-28367 のアドバイザリに記載されている脆弱性の影響を受けます。

  - Go 1.14.12 、および Go 1.15.5 より前の cgo を伴う go コマンドのコードインジェクションにより、#cgo ディレクティブで指定された悪意ある gcc フラグを介して、ビルド時に任意のコードが実行される可能性があります。CVE-2020-28367

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Go 1.14.12 、および Go 1.15.5 より前の cgo を伴う go コマンドのコードインジェクションにより、#cgo ディレクティブで指定された悪意ある gcc フラグを介して、ビルド時に任意のコードが実行される可能性があります。CVE-2020-28367

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

This update for go1.14 fixes the following issues :

go1.14.12 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages.

  - go#42553 math/big: panic during recursive division of     very large numbers (bsc#1178750 CVE-2020-28362)

  - go#42560 cmd/go: arbitrary code can be injected into cgo     generated files (bsc#1178752 CVE-2020-28367)

  - go#42557 cmd/go: improper validation of cgo flags can     lead to remote code execution at build time (bsc#1178753     CVE-2020-28366)

  - go#42155 time: Location interprets wrong timezone (DST)     with slim zoneinfo

  - go#42112 x/net/http2: the first write error on a     connection will cause all subsequent write requests to     fail blindly

  - go#41991 runtime: macOS-only segfault on 1.14+ with     'split stack overflow'

  - go#41913 net/http: request.Clone doesn't deep copy     TransferEncoding

  - go#41703 runtime: macOS syscall.Exec can get SIGILL due     to preemption signal

  - go#41386 x/net/http2: connection-level flow control not     returned if stream errors, causes server hang

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5493 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Go project reports :

A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures). Multiple math/big.Rat methods are similarly affected.

The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by a malicious gcc flags specified via a #cgo directive.

The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol names.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0060 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-14809:
    net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a hostname of google.com.

    CVE-2020-14040:
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.

    CVE-2020-28362:
    Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. A flaw was found in the math/big     package of Go's standard library that causes a denial of service. Applications written in Go that use     math/big via cryptographic packages, including crypto/rsa and crypto/x509, are vulnerable and can     potentially cause panic via a crafted certificate chain. The highest threat from this vulnerability is to     system availability.

    CVE-2020-28366:
    Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. An input validation vulnerability was     found in Go. From a generated go file (from the cgo tool), it is possible to modify symbols within that     object file and specify code. This flaw allows an attacker to create a repository that includes malicious     pre-built object files that could execute arbitrary code when downloaded and run via `go get` or `go     build` while building a Go project. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability.

    CVE-2020-28367:
    Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. An input validation vulnerability     was found in Go. If cgo is specified in a Go file, it is possible to bypass the validation of arguments to     the gcc compiler. This flaw allows an attacker to create a malicious repository that can execute arbitrary     code when downloaded and run via `go get` or `go build` while building a Go project. The highest threat     from this vulnerability is to confidentiality and integrity as well as system availability.

    CVE-2021-3114:
    In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field. A flaw     detected in golang: crypto/elliptic, in which P-224 keys as generated can return incorrect inputs,     reducing the strength of the cryptography. The highest threat from this vulnerability is confidentiality     and integrity.

    CVE-2021-27918:
    encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader     (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode,     DecodeElement, or Skip method.

    CVE-2021-31525:
    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations.

    CVE-2021-33196:
    In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic.

    CVE-2021-34558:
    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang / python-tensorboard installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-28367 advisory.

  - Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution     at build time via malicious gcc flags specified via a #cgo directive. (CVE-2020-28367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution     at build time via malicious gcc flags specified via a #cgo directive. (CVE-2020-28367)

Note that Nessus relies on the presence of the package as reported by the vendor.

- Rebase to go1.14.13

  - Security fix for CVE-2020-28362, CVE-2020-28367 and     CVE-2020-28366

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of golang installed on the remote host is prior to 1.15.5-1.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1471 advisory.

    Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

    Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. (CVE-2020-28366)

    Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. (CVE-2020-28367)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for go1.15 fixes the following issues :

  - go1.15.5 (released 2020-11-12) includes security fixes     to the cmd/go and math/big packages.

  - go#42553 math/big: panic during recursive division of     very large numbers (bsc#1178750 CVE-2020-28362)

  - go#42560 cmd/go: arbitrary code can be injected into cgo     generated files (bsc#1178752 CVE-2020-28367)

  - go#42557 cmd/go: improper validation of cgo flags can     lead to remote code execution at build time (bsc#1178753     CVE-2020-28366)

  - go#42169 cmd/compile, runtime, reflect: pointers to     go:notinheap types must be stored indirectly in     interfaces

  - go#42151 cmd/cgo: opaque struct pointers are broken     since Go 1.15.3

  - go#42138 time: Location interprets wrong timezone (DST)     with slim zoneinfo

  - go#42113 x/net/http2: the first write error on a     connection will cause all subsequent write requests to     fail blindly

  - go#41914 net/http: request.Clone doesn't deep copy     TransferEncoding

  - go#41704 runtime: macOS syscall.Exec can get SIGILL due     to preemption signal

  - go#41463 compress/flate: deflatefast produces corrupted     output

  - go#41387 x/net/http2: connection-level flow control not     returned if stream errors, causes server hang

  - go#40974 cmd/link: sectionForAddress(0xA9D67F) address     not in any section file

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5333 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)

    * golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for go1.14 fixes the following issues :

  - go1.14.12 (released 2020-11-12) includes security fixes     to the cmd/go and math/big packages.

  - go#42553 math/big: panic during recursive division of     very large numbers (bsc#1178750 CVE-2020-28362)

  - go#42560 cmd/go: arbitrary code can be injected into cgo     generated files (bsc#1178752 CVE-2020-28367)

  - go#42557 cmd/go: improper validation of cgo flags can     lead to remote code execution at build time (bsc#1178753     CVE-2020-28366)

  - go#42155 time: Location interprets wrong timezone (DST)     with slim zoneinfo

  - go#42112 x/net/http2: the first write error on a     connection will cause all subsequent write requests to     fail blindly

  - go#41991 runtime: macOS-only segfault on 1.14+ with     'split stack overflow'

  - go#41913 net/http: request.Clone doesn't deep copy     TransferEncoding

  - go#41703 runtime: macOS syscall.Exec can get SIGILL due     to preemption signal

  - go#41386 x/net/http2: connection-level flow control not     returned if stream errors, causes server hang

This update was imported from the SUSE:SLE-15:Update update project.

An update of the go package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
215575	Azure Linux 3.0 セキュリティ更新golang/python-tensorboardCVE-2020-28367	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/2/10	high
250927	Linux Distros のパッチ未適用の脆弱性: CVE-2020-28367	Nessus	Misc.	2025/8/18	2025/8/18	high
143648	SUSE SLED15 / SLES15 Security Update : go1.14 (SUSE-SU-2020:3369-1)	Nessus	SuSE Local Security Checks	2020/12/9	2021/7/2	high
144407	RHEL 8 : go-toolset:rhel8 (RHSA-2020:5493)	Nessus	Red Hat Local Security Checks	2020/12/18	2025/3/20	high
144699	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1025)	Nessus	Huawei Local Security Checks	2021/1/4	2022/5/11	high
142883	FreeBSD : go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo (db4b2f27-252a-11eb-865c-00155d646400)	Nessus	FreeBSD Local Security Checks	2020/11/13	2021/7/6	high
236611	Alibaba Cloud Linux 3 : 0060: go-toolset:rhel8 (ALINUX3-SA-2021:0060)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
215575	Azure Linux 3.0 Security Update: golang / python-tensorboard (CVE-2020-28367)	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/2/10	high
250927	Linux Distros Unpatched Vulnerability : CVE-2020-28367	Nessus	Misc.	2025/8/18	2025/8/18	high
144315	Fedora 32 : golang (2020-e971480183)	Nessus	Fedora Local Security Checks	2020/12/16	2021/7/6	high
145749	EulerOS 2.0 SP8 : golang (EulerOS-SA-2021-1144)	Nessus	Huawei Local Security Checks	2021/2/1	2024/1/25	high
144999	Amazon Linux AMI : golang (ALAS-2021-1471)	Nessus	Amazon Linux Local Security Checks	2021/1/14	2024/12/11	high
143457	openSUSE Security Update : go1.15 (openSUSE-2020-2139)	Nessus	SuSE Local Security Checks	2020/12/3	2021/7/6	high
143469	RHEL 7 : go-toolset-1.14-golang (RHSA-2020:5333)	Nessus	Red Hat Local Security Checks	2020/12/3	2024/11/7	high
143337	openSUSE Security Update : go1.14 (openSUSE-2020-2047)	Nessus	SuSE Local Security Checks	2020/11/30	2021/7/6	high
144064	Photon OS 3.0: Go PHSA-2020-3.0-0173	Nessus	PhotonOS Local Security Checks	2020/12/10	2025/8/22	high

检测

插件搜索

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high