The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1819 advisory.

  - golang: Command-line arguments may overwrite global data (CVE-2021-38297)

  - golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of     CVE-2021-33196) (CVE-2021-39293)

  - golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

  - golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

  - golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString     (CVE-2022-23772)

  - golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

  - golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1819 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: Command-line arguments may overwrite global data (CVE-2021-38297)

    * golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of     CVE-2021-33196) (CVE-2021-39293)

    * golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

    * golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

    * golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString     (CVE-2022-23772)

    * golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

    * golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-41771 advisory.

  - ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
    (CVE-2021-41771)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3530:01 advisory.

    * golang: Command-line arguments may overwrite global data (CVE-2021-38297)
      * golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of     CVE-2021-33196) (CVE-2021-39293)
      * golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)
      * golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)
      * golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString     (CVE-2022-23772)
      * golang: cmd/go: misinterpretation of branch names can lead to incorrect access control     (CVE-2022-23773)
      * golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0131 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-38297:
    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function     invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

    CVE-2021-39293:
    In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating     that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of     an incomplete fix for CVE-2021-33196.

    CVE-2021-41771:
    ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

    CVE-2021-41772:
    Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP     archive containing an invalid name or an empty filename field.

    CVE-2021-44716:
    net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the     header canonicalization cache via HTTP/2 requests.

    CVE-2021-44717:
    Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or     unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-     descriptor exhaustion.

    CVE-2022-23772:
    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption.

    CVE-2022-23773:
    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags.

    CVE-2022-23806:
    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element.

    CVE-2022-24675:
    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount     of PEM data.

    CVE-2022-24921     regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested     expression.

    CVE-2022-28327:
    The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic     via long scalar input.

    CVE-2022-29526:
    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero     flags parameter, the Faccessat function could incorrectly report that a file is accessible.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2021-007 advisory.

    A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm     GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from     the arguments. The highest threat from this vulnerability is to integrity. (CVE-2021-38297)

    An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the     debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat, it can     cause golang to attempt to read outside of a slice (array) causing a panic when calling ImportedSymbols.
    An attacker can use this vulnerability to craft a file which causes an application using this library to     crash resulting in a denial of service. (CVE-2021-41771)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where     Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can panic when parsing a crafted ZIP     archive containing completely invalid names or an empty filename argument. (CVE-2021-41772)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
    (CVE-2021-41771)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
160902	CentOS 8 : go-toolset:rhel8 (CESA-2022:1819)	Nessus	CentOS Local Security Checks	2022/5/10	2023/10/27	critical
161000	RHEL 8 : go-toolset:rhel8 (RHSA-2022:1819)	Nessus	Red Hat Local Security Checks	2022/5/11	2025/3/13	critical
172787	CBL Mariner 2.0 Security Update: golang (CVE-2021-41771)	Nessus	MarinerOS Local Security Checks	2023/3/20	2026/1/22	high
294331	MiracleLinux 8 : go-toolset:rhel8 (AXSA:2022-3530:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	critical
236557	Alibaba Cloud Linux 3 : 0131: go-toolset:rhel8 (ALINUX3-SA-2022:0131)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
212485	Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2021-007)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2024/12/16	critical
251013	Linux Distros Unpatched Vulnerability : CVE-2021-41771	Nessus	Misc.	2025/8/18	2026/8/4	high

检测

插件搜索

critical

critical

high

critical

critical

critical

high