The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7529 advisory.

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

  - golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

  - prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

  - golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

  - golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

  - golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

  - golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

  - golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

  - golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-047 advisory.

    2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from     this advisory.

    A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating     chunked encoding. This issue could allow request smuggling, but only if combined with an intermediate     server that also improperly accepts the header as invalid. (CVE-2022-1705)

    A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go     source code, which contains deeply nested types or declarations, a panic can occur due to stack     exhaustion. This issue allows an attacker to impact system availability. (CVE-2022-1962)

    A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a     large PEM input (more than 5 MB) ), causing a stack overflow in Decode, which leads to a loss of     availability. (CVE-2022-24675)

    A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to     fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling     an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191)

    A flaw was found in golang encoding/xml. When calling Decoder.Skip while parsing a deeply nested XML     document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
    (CVE-2022-28131)

    An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to     use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to     panic, leading to a loss of availability. (CVE-2022-28327)

    A flaw was found in the syscall.Faccessat function when calling a process by checking the group. This flaw     allows an attacker to check the process group permissions rather than a member of the file's group,     affecting system availability. (CVE-2022-29526)

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

    A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large     number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to     impact availability. (CVE-2022-30630)

    A flaw was found in golang. Calling the Reader.Read method on an archive that contains a large number of     concatenated 0-length compressed files can cause a panic issue due to stack exhaustion. (CVE-2022-30631)

    A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can     cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
    (CVE-2022-30632)

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the any field tag. (CVE-2022-30633)

    A flaw was found in golang. When calling Decoder.Decode on a message that contains deeply nested     structures, a panic can occur due to stack exhaustion and allows an attacker to impact system     availability. (CVE-2022-30635)

    Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-046 advisory.

    2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from     this advisory.

    A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating     chunked encoding. This issue could allow request smuggling, but only if combined with an intermediate     server that also improperly accepts the header as invalid. (CVE-2022-1705)

    A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go     source code, which contains deeply nested types or declarations, a panic can occur due to stack     exhaustion. This issue allows an attacker to impact system availability. (CVE-2022-1962)

    A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a     large PEM input (more than 5 MB) ), causing a stack overflow in Decode, which leads to a loss of     availability. (CVE-2022-24675)

    A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to     fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling     an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191)

    A flaw was found in golang encoding/xml. When calling Decoder.Skip while parsing a deeply nested XML     document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
    (CVE-2022-28131)

    An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to     use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to     panic, leading to a loss of availability. (CVE-2022-28327)

    Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)

    A flaw was found in the syscall.Faccessat function when calling a process by checking the group. This flaw     allows an attacker to check the process group permissions rather than a member of the file's group,     affecting system availability. (CVE-2022-29526)

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

    A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large     number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to     impact availability. (CVE-2022-30630)

    A flaw was found in golang. Calling the Reader.Read method on an archive that contains a large number of     concatenated 0-length compressed files can cause a panic issue due to stack exhaustion. (CVE-2022-30631)

    A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can     cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
    (CVE-2022-30632)

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the any field tag. (CVE-2022-30633)

    A flaw was found in golang. When calling Decoder.Decode on a message that contains deeply nested     structures, a panic can occur due to stack exhaustion and allows an attacker to impact system     availability. (CVE-2022-30635)

    Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

    Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2802 advisory.

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via a deeply nested XML document. (CVE-2022-28131)

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a     panic due to stack exhaustion via a path which contains a large number of path separators.
    (CVE-2022-30630)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to     replace a normal file in a volume with a symlink while exporting the volume, allowing for access to     arbitrary files on the host file system. (CVE-2023-0778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2758 advisory.

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via a deeply nested XML document. (CVE-2022-28131)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a     panic due to stack exhaustion via a path which contains a large number of path separators.
    (CVE-2022-30630)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to     replace a normal file in a volume with a symlink while exporting the volume, allowing for access to     arbitrary files on the host file system. (CVE-2023-0778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2758 advisory.

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
    * podman: symlink exchange attack in podman export volume (CVE-2023-0778)
    * golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)
    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0407 advisory.

    OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container     Platform.This advisory contains OpenShift Virtualization 4.12.0 RPMs.

    Security Fix(es):

    * golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716)

    * golang: out-of-bounds read in golang.org/x/text/language leads to DoS (CVE-2021-38561)

    * golang: syscall: don't close fd 0 on ForkExec error (CVE-2021-44717)

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

    * golang: regexp: stack exhaustion via a deeply nested expression (CVE-2022-24921)

    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    * golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6113 advisory.

    This release addresses several security issues in the underlying golang compiler by moving to golang     version 1.17.12.

    Security Fixes:

    Important:
    - golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    Moderate:
    - golang: net/http: improper sanitization of Transfer-Encoding header     (CVE-2022-1705)
    - golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
    - golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
    - golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
    - golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
    - golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
    - golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For     not working (CVE-2022-32148)

    For more details about the security issue(s), including the impact; a CVSS     score; acknowledgments; and other related information refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-055 advisory.

    Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

    Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

    A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a     large PEM input (more than 5 MB) ), causing a stack overflow in Decode, which leads to a loss of     availability. (CVE-2022-24675)

    A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to     fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling     an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191)

    A flaw was found in golang encoding/xml. When calling Decoder.Skip while parsing a deeply nested XML     document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
    (CVE-2022-28131)

    An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to     use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to     panic, leading to a loss of availability. (CVE-2022-28327)

    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug     was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty     inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with     inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This     bug did not affect the container security sandbox as the inheritable set never contained more capabilities     than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix     changes `runc exec --cap` behavior such that the additional capabilities granted to the process being     executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc     spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`)     file. (CVE-2022-29162)

    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero     flags parameter, the Faccessat function could incorrectly report that a file is accessible.
    (CVE-2022-29526)

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

    A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large     number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to     impact availability. (CVE-2022-30630)

    A flaw was found in golang. Calling the Reader.Read method on an archive that contains a large number of     concatenated 0-length compressed files can cause a panic issue due to stack exhaustion. (CVE-2022-30631)

    A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can     cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
    (CVE-2022-30632)

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the any field tag. (CVE-2022-30633)

    A flaw was found in golang. When calling Decoder.Decode on a message that contains deeply nested     structures, a panic can occur due to stack exhaustion and allows an attacker to impact system     availability. (CVE-2022-30635)

    Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3736:01 advisory.

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
      * golang: net/http: improper sanitization of Transfer-Encoding header     (CVE-2022-1705)
      * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
      * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
      * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
      * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
      * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For     not working (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4363:06 advisory.

    * sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
      * golang: net/[http:](http:) improper sanitization of Transfer-Encoding header (CVE-2022-1705)
      * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
      * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
      * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
      * grafana: XSS vulnerability in data source handling (CVE-2022-21702)
      * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
      * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
      * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
      * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
      * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
      * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working     (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4035:01 advisory.

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
      * golang: net/[http:](http:) improper sanitization of Transfer-Encoding header (CVE-2022-1705)
      * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
      * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
      * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
      * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
      * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working     (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167185	CentOS 8 : container-tools:3.0 (CESA-2022:7529)	Nessus	CentOS Local Security Checks	2022/11/9	2023/10/5	medium
173133	Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2023-047)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	medium
173138	Amazon Linux 2023 : golist (ALAS2023-2023-046)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	high
175893	CentOS 8 : container-tools:4.0 (CESA-2023:2802)	Nessus	CentOS Local Security Checks	2023/5/16	2024/2/8	high
176149	CentOS 8 : container-tools:rhel8 (CESA-2023:2758)	Nessus	CentOS Local Security Checks	2023/5/20	2024/2/8	medium
176167	AlmaLinux 8 : container-tools:rhel8 (ALSA-2023:2758)	Nessus	Alma Linux Local Security Checks	2023/5/20	2025/1/13	medium
194211	RHEL 7 / 8 : OpenShift Virtualization 4.12.0 RPMs (RHSA-2023:0407)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	medium
194269	RHEL 8 : Red Hat Application Interconnect 1.0 Release (rpms) (Important) (RHSA-2022:6113)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	medium
234976	Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2025-055)	Nessus	Amazon Linux Local Security Checks	2025/4/29	2025/10/30	high
292080	MiracleLinux 8 : go-toolset:rhel8 (AXSA:2022-3736:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	medium
293531	MiracleLinux 8 : grafana-7.5.15-3.el8 (AXSA:2022-4363:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	high
293614	MiracleLinux 9 : golang-1.17.12-1.el9, go-toolset-1.17.12-1.el9 (AXSA:2022-4035:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	medium
203301	Photon OS 4.0: Go PHSA-2022-4.0-0242	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/29	high
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical

检测

插件搜索

medium

medium

high

high

medium

medium

medium

medium

high

medium

high

medium

high

critical