The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2127-1 advisory.

    Update to 1.19.9 (bnc#1200441):
    - CVE-2023-24539: fixed an improper sanitization of CSS values       (bnc#1211029).
    - CVE-2023-24540: fixed an improper handling of JavaScript whitespace       (bnc#1211030).
    - CVE-2023-29400: fixed an improper handling of empty HTML attributes       (bnc#1211031).
    - runtime: automatically bump RLIMIT_NOFILE on Unix
    - cmd/compile: inlining function that references function literals       generates bad code.
    - cmd/compile: encoding/binary.PutUint16 sometimes doesn't write.
    - crypto/tls: TLSv1.3 connection fails with invalid PSK binder.
    - cmd/compile: incorrect inline function variable.

    Non-security fixes:

    - Various packaging fixes (boo#1210963, boo#1210938, boo#1211073)
    - Reduced install size (jsc#PED-1962).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3318 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3366 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.2. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:3367

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

    * golang: path/filepath: path-filepath filepath.Clean path traversal (CVE-2022-41722)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7061-1 advisory.

    Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An     attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531)

    Sohom Datta discovered that Go did not properly validate backticks (`) as Javascript string delimiters,     and did not escape them as expected. An attacker could possibly use this issue to inject arbitrary     Javascript code into the Go template. (CVE-2023-24538)

    Juho Nurminen discovered that Go incorrectly handled certain special characters in directory or file     paths. An attacker could possibly use this issue to inject code into the resulting binaries.
    (CVE-2023-29402)

    Vincent Dehors discovered that Go incorrectly handled permission bits. An attacker could possibly use this     issue to read or write files with elevated privileges. (CVE-2023-29403)

    Juho Nurminen discovered that Go incorrectly handled certain crafted arguments. An attacker could possibly     use this issue to execute arbitrary code at build time. (CVE-2023-29405)

    It was discovered that Go incorrectly validated the contents of host headers. A remote attacker could     possibly use this issue to inject additional headers or entire requests. (CVE-2023-29406)

    Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context     of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a     cross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)

    It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the     net/http module. An attacker could possibly use this issue to cause a panic resulting in a denial of     service. (CVE-2023-39325)

    It was discovered that the Go html/template module did not validate errors returned from MarshalJSON     methods. An attacker could possibly use this issue to inject arbitrary code into the Go template.
    (CVE-2024-24785)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1792-1 advisory.

    Update to 1.19.8

    * CVE-2023-24534: security: net/http, net/textproto: denial of service from excessive memory allocation     (bsc#1210127)
    * CVE-2023-24536: security: net/http, net/textproto, mime/multipart: denial of service from excessive     resource consumption (bsc#1210128)
    * CVE-2023-24537: security: go/parser: infinite loop in parsing (bsc#1210129)
    * CVE-2023-24538: security: html/template: backticks not treated as string delimiters (bsc#1210130)
    * cmd/go: timeout on darwin-amd64-race builder
    * runtime/pprof: TestLabelSystemstack due to sample with no location
    * internal/testpty: fails on some Linux machines due to incorrect error handling
    * cmd/link: linker fails on linux/amd64 when gcc's lto options are used
    * cmd/link/internal/arm: off-by-one error in trampoline phase call reachability calculation
    * time: time zone lookup using extend string makes wrong start time for non-DST zones
    * runtime: crash on linux-ppc64le

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3540 advisory.

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
175366	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.19 (SUSE-SU-2023:2127-1)	Nessus	SuSE Local Security Checks	2023/5/10	2026/6/25	critical
176357	RHEL 9 : go-toolset and golang (RHSA-2023:3318)	Nessus	Red Hat Local Security Checks	2023/5/25	2025/3/6	critical
194248	RHEL 8 / 9 : OpenShift Container Platform 4.13.2 (RHSA-2023:3366)	Nessus	Red Hat Local Security Checks	2024/4/28	2025/8/15	critical
208702	Ubuntu 22.04 LTS : Go vulnerabilities (USN-7061-1)	Nessus	Ubuntu Local Security Checks	2024/10/10	2024/10/10	critical
174013	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.19 (SUSE-SU-2023:1792-1)	Nessus	SuSE Local Security Checks	2023/4/7	2026/6/25	critical
312055	RHCOS 4 : OpenShift Container Platform 4.13.3 (RHSA-2023:3540)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical