An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - golang: arbitrary command execution via VCS path (CVE-2018-7187)

  - golang: malformed hosts in URLs leads to authorization bypass (CVE-2019-14809)

  - On Darwin, user's trust preferences for root certificates were not honored. If the user had a root     certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a     connection using that root certificate. (CVE-2017-1000097)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1519 advisory.

  - An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP     header or a Redis command. (CVE-2019-9741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service (DoS), bypasss access control, and execute arbitrary code on the developer's computer.

CVE-2017-15041

Go allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.'

CVE-2018-16873

The 'go get' command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, as it may treat the parent directory as a Git repository root, containing malicious configuration.

CVE-2018-16874

The 'go get' command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CVE-2019-9741

In net/http, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVE-2019-16276

Go allows HTTP Request Smuggling.

CVE-2019-17596

Go can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVE-2021-3114

crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

For Debian 9 stretch, these problems have been fixed in version 1.8.1-1+deb9u3.

We recommend that you upgrade your golang-1.8 packages.

For the detailed security status of golang-1.8 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.8

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service (DoS), bypasss access control, and execute arbitrary code on the developer's computer.

CVE-2017-15041

Go allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.'

CVE-2018-16873

The 'go get' command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, as it may treat the parent directory as a Git repository root, containing malicious configuration.

CVE-2018-16874

The 'go get' command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CVE-2019-9741

In net/http, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVE-2019-16276

Go allows HTTP Request Smuggling.

CVE-2019-17596

Go can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVE-2021-3114

crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

For Debian 9 stretch, these problems have been fixed in version 1.7.4-2+deb9u3.

We recommend that you upgrade your golang-1.7 packages.

For the detailed security status of golang-1.7 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.7

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1519 advisory.

  - golang: CRLF injection in net/http (CVE-2019-9741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

An issue was discovered in net/http in Go. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command. (CVE-2019-9741)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1519 advisory.

  - golang: CRLF injection in net/http (CVE-2019-9741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1300 advisory.

  - golang: CRLF injection in net/http (CVE-2019-9741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Rebase to go1.11.6

  - Security fix for CVE-2019-9741

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a CRLF injection attack in the Go programming language runtime library.

Passing \r\n to http.NewRequest could allow execution of arbitrary HTTP headers or Redis commands.

For Debian 8 'Jessie', this issue has been fixed in golang version 2:1.3.3-1+deb8u2.

We recommend that you upgrade your golang packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199297	RHEL 7 : golang (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
180757	Oracle Linux 8 : go-toolset:rhel8 (ELSA-2019-1519)	Nessus	Oracle Linux Local Security Checks	medium
147800	Debian DLA-2592-1 : golang-1.8 security update	Nessus	Debian Local Security Checks	critical
147797	Debian DLA-2591-1 : golang-1.7 security update	Nessus	Debian Local Security Checks	critical
145620	CentOS 8 : go-toolset:rhel8 (CESA-2019:1519)	Nessus	CentOS Local Security Checks	medium
128175	Photon OS 2.0: Go PHSA-2019-2.0-0168	Nessus	PhotonOS Local Security Checks	medium
127066	Amazon Linux AMI : golang (ALAS-2019-1238)	Nessus	Amazon Linux Local Security Checks	medium
126028	RHEL 8 : go-toolset:rhel8 (RHSA-2019:1519)	Nessus	Red Hat Local Security Checks	medium
125711	RHEL 7 : go-toolset-1.11-golang (RHSA-2019:1300)	Nessus	Red Hat Local Security Checks	medium
123979	Fedora 29 : golang (2019-d05bc7e3df)	Nessus	Fedora Local Security Checks	medium
123690	Debian DLA-1749-1 : golang security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-9741

medium

Tenable Plugins

critical

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium