The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0121 advisory.

    * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
    * golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
    * golang: html/template:  improper handling of HTML-like comments within script contexts (CVE-2023-39318)
    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

  - The html/template package does not properly handle HTML-like '' comment tokens, nor hashbang '#!' comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of '<script', '<!--',     and '</script' within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5008 advisory.

    Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge     device deployments and is built from the edge capabilities of Red Hat OpenShift. MicroShift is an     application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an     efficient way to operate single-node clusters in these low-resource environments.

    This advisory contains the RPM packages for Red Hat build of MicroShift 4.14.0. Read the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:5006

    All of the bug fixes may not be documented in this advisory. Read the following release notes     documentation for details about these changes:

    https://access.redhat.com/documentation/en-us/red_hat_build_of_microshift/4.14/html/release_notes/index

    Security Fix(es):

    * kube-apiserver: PrivEsc (CVE-2023-1260)

    * kube-apiserver: Bypassing policies imposed by the ImagePolicyWebhook  admission plugin (CVE-2023-2727)

    * kube-apiserver: Bypassing enforce mountable secrets policy imposed by the  ServiceAccount admission     plugin (CVE-2023-2728)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2160 advisory.

    Toolbox is a tool for Linux operating systems, which allows the use of containerized command line     environments. It is built on top of Podman and other standard container technologies from OCI.

    Security Fix(es):

    * golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0121 advisory.

    * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    * golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

    * golang: html/template:  improper handling of HTML-like comments within script contexts (CVE-2023-39318)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0627 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-39325:
    A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function.

    CVE-2023-39318:
    The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack.

    CVE-2023-39319:
    The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack.

    CVE-2023-45285:
    Using go get to fetch a module with the .git suffix may unexpectedly fallback to the insecure git://     protocol if the module is unavailable via the secure https:// and git+ssh:// protocols, even if     GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are     fetching modules directly (i.e. GOPROXY=off).

    CVE-2023-39326:
    A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response     body to read many more bytes from the network than are in the body. A malicious HTTP client can further     exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a     handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which     permit including additional metadata in a request or response body sent using the chunked encoding. The     net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large     metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real     body to encoded bytes grows too small.

    CVE-2023-39323:
    Line directives (//line) can be used to bypass the restrictions on //go:cgo_ directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running go build. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0101 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2018-25091:
    urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect     (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the     authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue     exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

    CVE-2021-33198:
    In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method.

    CVE-2021-34558:
    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic.

    CVE-2022-2879:
    Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

    CVE-2022-2880:
    Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged.

    CVE-2022-41715:
    Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected.

    CVE-2023-29409:
    Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable.

    CVE-2023-39318:
    The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack.

    CVE-2023-39319:
    The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack.

    CVE-2023-39321:
    Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

    CVE-2023-39322:
    QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake     messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now     consistently reject messages larger than 65KiB in size.

    CVE-2023-39326:
    A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response     body to read many more bytes from the network than are in the body. A malicious HTTP client can further     exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a     handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which     permit including additional metadata in a request or response body sent using the chunked encoding. The     net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large     metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real     body to encoded bytes grows too small.

    CVE-2023-45287:
    Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA     blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective.
    In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn     could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant     time RSA implementation, which we do not believe exhibits any timing side channels.

    CVE-2023-45803:
    urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body.

    CVE-2023-48795:
    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust.

    CVE-2024-1753:
    A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary     locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image     with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the     host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write     access to the host filesystem, allowing for full container escape at build time.

    CVE-2024-23650:
    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to     BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using     BuildKit frontends from untrusted sources.

    CVE-2024-24786:
    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set.

    CVE-2024-28180:
    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7109-1 advisory.

    Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly     use this issue to cause a denial of service. (CVE-2022-41723)

    Marten Seemann discovered that Go did not properly manage memory under certain circumstances. An attacker     could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41724)

    Ameya Darshan and Jakob Ackermann discovered that Go did not properly validate the amount of memory and     disk files ReadForm can consume. An attacker could possibly use this issue to cause a panic resulting in a     denial of service. (CVE-2022-41725)

    Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An     attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531)

    Jakob Ackermann discovered that Go incorrectly handled multipart forms. An attacker could possibly use     this issue to consume an excessive amount of resources, resulting in a denial of service. (CVE-2023-24536)

    Juho Nurminen discovered that Go incorrectly handled certain special characters in directory or file     paths. An attacker could possibly use this issue to inject code into the resulting binaries.
    (CVE-2023-29402)

    Vincent Dehors discovered that Go incorrectly handled permission bits. An attacker could possibly use this     issue to read or write files with elevated privileges. (CVE-2023-29403)

    Juho Nurminen discovered that Go incorrectly handled certain compiler directives. An attacker could     possibly use this issue to execute arbitrary code. (CVE-2023-29404)

    Juho Nurminen discovered that Go incorrectly handled certain crafted arguments. An attacker could possibly     use this issue to execute arbitrary code at build time. (CVE-2023-29405)

    Bartek Nowotarski discovered that Go incorrectly validated the contents of host headers. A remote attacker     could possibly use this issue to inject additional headers or entire requests. (CVE-2023-29406)

    Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context     of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a     cross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)

    It was discovered that Go did not properly validate the //go:cgo_ directives during compilation. An     attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323)

    It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the     net/http module. An attacker could possibly use this issue to cause a panic resulting in a denial of     service. (CVE-2023-39325)

    Bartek Nowotarski was discovered that the Go net/http module did not properly handle the requests when     request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic     resulting into a denial of service. (CVE-2023-45288)

    Bartek Nowotarski discovered that the Go net/http module did not properly validate the total size of the     parsed form when parsing a multipart form. An attacker could possibly use this issue to cause a panic     resulting into a denial of service. (CVE-2023-45290)

    John Howard discovered that the Go crypto/x509 module did not properly handle a certificate chain which     contains a certificate with an unknown public key algorithm. An attacker could possibly use this issue to     cause a panic resulting into a denial of service. (CVE-2024-24783)

    Juho Nurminen discovered that the Go net/mail module did not properly handle comments within display names     in the ParseAddressList function. An attacker could possibly use this issue to cause a panic resulting     into a denial of service. (CVE-2024-24784)

    It was discovered that the Go html/template module did not validate errors returned from MarshalJSON     methods. An attacker could possibly use this issue to inject arbitrary code into the Go template.
    (CVE-2024-24785)

    Yufan You discovered that the Go archive/zip module did not properly handle certain types of invalid zip     files differs from the behavior of most zip implementations. An attacker could possibly use this issue to     cause a panic resulting into a denial of service. (CVE-2024-24789)

    Enze Wang and Jianjun Chen discovered that the Go net/netip module did not work as expected for     IPv4-mapped IPv6 addresses in various Is methods. An attacker could possibly use this issue to cause a     panic resulting into a denial of service. (CVE-2024-24790)

    Geoff Franks discovered that the Go net/http module did not properly handle responses to requests with an     Expect: 100-continue header under certain circumstances. An attacker could possibly use this issue to     cause a denial of service. (CVE-2024-24791)

    It was discovered that the Go parser module did not properly handle deeply nested literal values. An     attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34155)

    Md Sakib Anwar discovered that the Go encoding/gob module did not properly handle message decoding under     certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of     service. (CVE-2024-34156)

    It was discovered that the Go build module did not properly handle certain build tag lines with deeply     nested expressions. An attacker could possibly use this issue to cause a panic resulting in a denial of     service. (CVE-2024-34158)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:3352 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform     (CVE-2024-4438)

    * Incomplete fix for CVE-2021-44716 in OpenStack Platform (CVE-2024-4437)

    * Incomplete fix for CVE-2022-41723 in OpenStack Platform (CVE-2024-4436)

    * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

    * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:3467 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform     (CVE-2024-4438)

    * Incomplete fix for CVE-2021-44716 in OpenStack Platform (CVE-2024-4437)

    * Incomplete fix for CVE-2022-41723 in OpenStack Platform (CVE-2024-4436)

    * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

    * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202311-09 (Go: Multiple Vulnerabilities)

  - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests. (CVE-2022-41723)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

  - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
    (CVE-2023-24534)

  - Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

  - Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow. (CVE-2023-24537)

  - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution. (CVE-2023-24538)

  - The go command may generate unexpected code at build time when using cgo. This may result in unexpected     behavior when running a go program which uses cgo. This may occur when running an untrusted module which     contains directories with newline characters in their names. Modules which are retrieved using the go     command, i.e. via go get, are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off,     may be affected). (CVE-2023-29402)

  - On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid     bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of     standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors     closed, opening any files can result in unexpected content being read or written with elevated privileges.
    Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents     of its registers. (CVE-2023-29403)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. The arguments for a number of flags     which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled     through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. (CVE-2023-29404)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

  - The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

  - The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries     relative to the root of the module when the go command was executed within the module. This applies to     modules downloaded using the go command from the module proxy, as well as modules downloaded directly     using VCS software. (CVE-2023-39320)

  - Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)

  - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake     messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now     consistently reject messages larger than 65KiB in size. (CVE-2023-39322)

  - Line directives (//line) can be used to bypass the restrictions on //go:cgo_ directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running go build. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex. (CVE-2023-39323)

  - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function. (CVE-2023-39325)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The html/template package does not properly handle HTML-like '' comment tokens, nor hashbang '#!' comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of '<script', '<!--',     and '</script' within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

  - Line directives ('//line') can be used to bypass the restrictions on '//go:cgo_' directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running 'go build'. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex. (CVE-2023-39323)

  - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function. (CVE-2023-39325)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6840 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.2. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:6837

    Security Fix(es):

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS     attack (Rapid Reset Attack) (CVE-2023-44487 CVE-2023-39325)
    * golang: net/http: insufficient sanitization of Host header     (CVE-2023-29406)
    * golang: crypto/tls: slow verification of certificate chains containing     large RSA keys (CVE-2023-29409)
    * golang: html/template:  improper handling of HTML-like comments within     script contexts (CVE-2023-39318)
    * golang: html/template: improper handling of special tags within script     contexts (CVE-2023-39319)
    * golang: crypto/tls: panic when processing post-handshake message on QUIC     connections (CVE-2023-39321)
    * golang: crypto/tls: lack of a limit on buffered post-handshake     (CVE-2023-39322)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
188008	AlmaLinux 8 : container-tools:4.0 (ALSA-2024:0121)	Nessus	Alma Linux Local Security Checks	2024/1/12	2025/1/13	high
188869	EulerOS 2.0 SP10 : golang (EulerOS-SA-2023-3213)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
194227	RHEL 9 : Red Hat build of MicroShift 4.14.0 (RHSA-2023:5008)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	high
194807	RHEL 9 : toolbox (RHSA-2024:2160)	Nessus	Red Hat Local Security Checks	2024/4/30	2025/3/6	medium
204239	Photon OS 5.0: Go PHSA-2023-5.0-0108	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
204352	Photon OS 4.0: Go PHSA-2023-4.0-0484	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
226039	Linux Distros Unpatched Vulnerability : CVE-2023-39319	Nessus	Misc.	2025/3/5	2026/1/27	medium
235537	RockyLinux 8 : container-tools:4.0 (RLSA-2024:0121)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	high
238620	TencentOS Server 4: golang (TSSA-2024:0627)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
236311	Alibaba Cloud Linux 3 : 0101: container-tools:rhel8 (ALINUX3-SA-2024:0101)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
210950	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Go vulnerabilities (USN-7109-1)	Nessus	Ubuntu Local Security Checks	2024/11/14	2024/11/14	critical
197874	RHEL 8 : Red Hat OpenStack Platform 16.2 (etcd) (RHSA-2024:3352)	Nessus	Red Hat Local Security Checks	2024/5/23	2024/11/7	medium
198073	RHEL 8 : Red Hat OpenStack Platform 16.1 (etcd) (RHSA-2024:3467)	Nessus	Red Hat Local Security Checks	2024/5/29	2024/11/7	medium
186294	GLSA-202311-09 : Go: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/11/27	2024/2/9	critical
188740	EulerOS 2.0 SP11 : golang (EulerOS-SA-2023-3242)	Nessus	Huawei Local Security Checks	2024/1/16	2024/2/9	high
194364	RHEL 8 / 9 : OpenShift Container Platform 4.14.2 (RHSA-2023:6840)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical

检测

插件搜索

high

medium

high

medium

medium

medium

medium

high

high

critical

critical

medium

medium

critical

high

critical