Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

An update of the go package has been released.

The version of golang installed on the remote host is prior to 1.13.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2545 advisory.

    2024-05-23: CVE-2019-16276 was added to this advisory.

    It was discovered that net/http (through net/textproto) in golang does not correctly interpret HTTP     requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to     smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or to filter     bypasses depending on the specific network configuration. (CVE-2019-16276)

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates. (CVE-2019-17596)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.13.4-1.57. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1938 advisory.

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server     that verifies client certificates. (CVE-2019-17596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service (DoS), bypasss access control, and execute arbitrary code on the developer's computer.

CVE-2017-15041

Go allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.'

CVE-2018-16873

The 'go get' command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, as it may treat the parent directory as a Git repository root, containing malicious configuration.

CVE-2018-16874

The 'go get' command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CVE-2019-9741

In net/http, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVE-2019-16276

Go allows HTTP Request Smuggling.

CVE-2019-17596

Go can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVE-2021-3114

crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

For Debian 9 stretch, these problems have been fixed in version 1.8.1-1+deb9u3.

We recommend that you upgrade your golang-1.8 packages.

For the detailed security status of golang-1.8 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.8

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service (DoS), bypasss access control, and execute arbitrary code on the developer's computer.

CVE-2017-15041

Go allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.'

CVE-2018-16873

The 'go get' command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, as it may treat the parent directory as a Git repository root, containing malicious configuration.

CVE-2018-16874

The 'go get' command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CVE-2019-9741

In net/http, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVE-2019-16276

Go allows HTTP Request Smuggling.

CVE-2019-17596

Go can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVE-2021-3114

crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

For Debian 9 stretch, these problems have been fixed in version 1.7.4-2+deb9u3.

We recommend that you upgrade your golang-1.7 packages.

For the detailed security status of golang-1.7 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.7

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0329 advisory.

  - golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling     (CVE-2019-16276)

  - golang: invalid public key causes panic in dsa.Verify (CVE-2019-17596)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0329 advisory.

    go-toolset     [1.12.12-1]
    - Update for golang package fixes

    [1.12.12-1]
    - Bump version to 1.12.12

    golang     [1.12.12-4.0.1]
    - from upstream https://github.com/golang/go/issues/2775
    - move arbitrary value 10% to 15% for GC tests, hits 10.48% on our
    - infrastructure
    - Resolves failing post build tests [Orabug: 30241946]

    [1.12.12-4]
    - Fix boring/aes_test.go tags

    [1.12.12-3]
    - Fix tarball

    [1.12.12-2]
    - Fix stub boring.(Sign/Verify)RSAPKCS1v15 functions

    [1.12.12-1]
    - Rebase to 1.12.12
    - Revert to Sign/Verify operations not expected unhashed inputs
    - Remove previously added verbose output
    - Better expose openssl errors

    [1.12.8-4]
    - Reduce number of threads when testing on i686

    [1.12.8-3]
    - Relax FIPS requirements to unblock OpenShift testing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data     race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a     request body and writes a response at the same     time.(CVE-2020-15586)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP     Request Smuggling.(CVE-2019-16276)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic     upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack     scenarios, such as traffic from a client to a server     that verifies client certificates.(CVE-2019-17596)

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the     crypto/cryptobyte package before     0.0.0-20200124225646-8b5121be2f68 for Go) allows     attacks on clients (resulting in a panic) via a     malformed X.509 certificate.(CVE-2020-7919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0329 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling     (CVE-2019-16276)

    * golang: invalid public key causes panic in dsa.Verify (CVE-2019-17596)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0101 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    The following packages have been upgraded to a later upstream version: go-toolset-1.12-golang (1.12.12).
    (BZ#1759840, BZ#1785389)

    Security Fix(es):

    * golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling     (CVE-2019-16276)

    * golang: invalid public key causes panic in dsa.Verify (CVE-2019-17596)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP     Request Smuggling.(CVE-2019-16276)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic     upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack     scenarios, such as traffic from a client to a server     that verifies client certificates.(CVE-2019-17596)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.12 fixes the following issues :

Security issues fixed :

  - CVE-2019-16276: Fixed the handling of invalid HTTP     headers, which had allowed request smuggling     (bsc#1152082).

  - CVE-2019-17596: Fixed a panic in dsa.Verify caused by     invalid public keys (bsc#1154402).

Non-security issue fixed :

  - Go was updated to version 1.12.12 (bsc#1141689).

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.12 fixes the following issues :

Security issues fixed :

CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).

CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).

Non-security issue fixed: Go was updated to version 1.12.12 (bsc#1141689).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebase to go1.12.13

----

  - Rebase to 1.12.12

  - Security fix for CVE-2019-17596

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-17596 Rebase to 1.13.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel Mandragona discovered that invalid DSA public keys can cause a panic in dsa.Verify(), resulting in denial of service.

ID	Name	Product	Family	Severity
203101	Photon OS 3.0: Go PHSA-2019-3.0-0037	Nessus	PhotonOS Local Security Checks	high
197112	Amazon Linux 2 : golang (ALAS-2024-2545)	Nessus	Amazon Linux Local Security Checks	high
196928	Amazon Linux AMI : golang (ALAS-2024-1938)	Nessus	Amazon Linux Local Security Checks	high
195780	RHEL 7 : golang (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
147800	Debian DLA-2592-1 : golang-1.8 security update	Nessus	Debian Local Security Checks	critical
147797	Debian DLA-2591-1 : golang-1.7 security update	Nessus	Debian Local Security Checks	critical
145950	CentOS 8 : go-toolset:rhel8 (CESA-2020:0329)	Nessus	CentOS Local Security Checks	high
140032	Oracle Linux 8 : go-toolset:ol8 (ELSA-2020-0329)	Nessus	Oracle Linux Local Security Checks	high
139134	EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-1804)	Nessus	Huawei Local Security Checks	high
133478	RHEL 8 : go-toolset:rhel8 (RHSA-2020:0329)	Nessus	Red Hat Local Security Checks	high
132981	Photon OS 1.0: Go PHSA-2020-1.0-0264	Nessus	PhotonOS Local Security Checks	high
132948	RHEL 7 : go-toolset-1.12-golang (RHSA-2020:0101)	Nessus	Red Hat Local Security Checks	high
131803	EulerOS 2.0 SP5 : golang (EulerOS-SA-2019-2529)	Nessus	Huawei Local Security Checks	high
131117	openSUSE Security Update : go1.12 (openSUSE-2019-2522)	Nessus	SuSE Local Security Checks	high
131116	openSUSE Security Update : go1.12 (openSUSE-2019-2521)	Nessus	SuSE Local Security Checks	high
130900	SUSE SLED15 / SLES15 Security Update : go1.12 (SUSE-SU-2019:2940-1)	Nessus	SuSE Local Security Checks	high
130782	Fedora 30 : golang (2019-34e097c66c)	Nessus	Fedora Local Security Checks	high
130410	Fedora 31 : golang (2019-4593120208)	Nessus	Fedora Local Security Checks	high
130290	Debian DSA-4551-1 : golang-1.11 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-17596

high

Tenable Plugins

high

high

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high