The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2312-1 advisory.

    - Add subpackage go1.x-libstd compiled shared object libstd.so (jsc#PED-1962)
      * Main go1.x package included libstd.so in previous versions
      * Split libstd.so into subpackage that can be installed standalone
      * Continues the slimming down of main go1.x package by 40 Mb
      * Experimental and not recommended for general use, Go currently has no ABI
      * Upstream Go has not committed to support buildmode=shared long-term
      * Do not use in packaging, build static single binaries (the default)
      * Upstream Go go1.x binary releases do not include libstd.so
      * go1.x Suggests go1.x-libstd so not installed by default Recommends
      * go1.x-libstd does not Require: go1.x so can install standalone
      * Provides go-libstd unversioned package name
      * Fix build step -buildmode=shared std to omit -linkshared
    - Packaging improvements:
      * go1.x Suggests go1.x-doc so not installed by default Recommends
      * Use Group: Development/Languages/Go instead of Other

    - Improvements to go1.x packaging spec:
      * On Tumbleweed bootstrap with current default gcc13 and gccgo118
      * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap         using go1.x package (%bcond_without gccgo). This is no longer         needed on current SLE-12:Update and removing will consolidate         the build configurations used.
      * Change source URLs to go.dev as per Go upstream
      * On x86_64 export GOAMD64=v1 as per the current baseline.
        At this time forgo GOAMD64=v3 option for x86_64_v3 support.
      * On x86_64 %define go_amd64=v1 as current instruction baseline

    - Update to version 1.18.10.1 cut from the go1.18-openssl-fips       branch at the revision tagged go1.18.10-1-openssl-fips.
      * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
      * Merge go1.18.10 into dev.boringcrypto.go1.18

    - go1.18.10 (released 2023-01-10) includes fixes to cgo, the       compiler, the linker, and the crypto/x509, net/http, and syscall       packages.
      Refs bsc#1193742 go1.18 release tracking
      * go#57705 misc/cgo: backport needed for dlltool fix
      * go#57426 crypto/x509: Verify on macOS does not return typed errors
      * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its     'old' argument.
      * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2     ARM devices
      * go#57213 os: TestLstat failure on Linux Aarch64
      * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with     reflect.MakeFunc and slice of sufficient length
      * go#57057 cmd/go: remove test dependency on gopkg.in service
      * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
      * go#57044 cgo: malformed DWARF TagVariable entry
      * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
      * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
      * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
      * go#56323 net/http: bad handling of HEAD requests with a body

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2004-1 advisory.

  - Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go     1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. (CVE-2022-29804)

  - Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in     the working directory named either ..com or ..exe by calling Cmd.Run, Cmd.Start, Cmd.Output, or     Cmd.CombinedOutput when Cmd.Path is unset. (CVE-2022-30580)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the     VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on     Windows). Thus, X.509 certificate verification is incomplete. (CVE-2020-14039)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - In Decoder.Skip in encoding/xml in Go before 1.17.12 and 1.18.x before 1.18.4, stack exhaustion and a     panic can occur via a deeply nested XML document. (CVE-2022-28131)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In filepath.Clean in path/filepath in Go before 1.17.11 and 1.18.x before 1.18.3 on Windows, invalid paths     such as .\c: could be converted to valid paths (such as c: in this example). (CVE-2022-29804)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
176517	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.18-openssl (SUSE-SU-2023:2312-1)	Nessus	SuSE Local Security Checks	2023/5/31	2026/6/25	high
161943	SUSE SLED15 / SLES15 Security Update : go1.17 (SUSE-SU-2022:2004-1)	Nessus	SuSE Local Security Checks	2022/6/8	2023/7/14	high
165035	EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2288)	Nessus	Huawei Local Security Checks	2022/9/14	2023/10/12	medium
166979	EulerOS 2.0 SP5 : golang (EulerOS-SA-2022-2710)	Nessus	Huawei Local Security Checks	2022/11/4	2023/10/5	high

检测

插件搜索

high

high

medium

high