In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the     VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on     Windows). Thus, X.509 certificate verification is incomplete. (CVE-2020-14039)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - In Decoder.Skip in encoding/xml in Go before 1.17.12 and 1.18.x before 1.18.4, stack exhaustion and a     panic can occur via a deeply nested XML document. (CVE-2022-28131)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.14 fixes the following issues :

  - go1.14 was updated to version 1.14.7 

  - CVE-2020-16845: dUvarint and ReadVarint can read an     unlimited number of bytes from invalid inputs     (bsc#1174977).&#9; 

  - go1.14.6 (released 2020-07-16) includes fixes to the go     command, the compiler, the linker, vet, and the     database/sql, encoding/json, net/http, reflect, and     testing packages. Refs bsc#1164903 go1.14 release     tracking Refs bsc#1174153 bsc#1174191

  - go#39991 runtime: missing deferreturn on linux/ppc64le

  - go#39920 net/http: panic on misformed If-None-Match     Header with http.ServeContent

  - go#39849 cmd/compile: internal compile error when using     sync.Pool: mismatched zero/store sizes

  - go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386     fails on linux/386 in Go 1.14 and 1.13, not 1.15

  - go#39698 reflect: panic from malloc after MakeFunc     function returns value that is also stored globally

  - go#39636 reflect: DeepEqual can return true for values     that are not equal

  - go#39585 encoding/json: incorrect object key     unmarshaling when using custom TextUnmarshaler as Key     with string va lues

  - go#39562 cmd/compile/internal/ssa:
    TestNexting/dlv-dbg-hist failing on linux-386-longtest     builder because it trie s to use an older version of dlv     which only supports linux/amd64

  - go#39308 testing: streaming output loses parallel     subtest associations

  - go#39288 cmd/vet: update for new number formats

  - go#39101 database/sql: context cancellation allows     statements to execute after rollback

  - go#38030 doc: BuildNameToCertificate deprecated in go     1.14 not mentioned in the release notes

  - go#40212 net/http: Expect 100-continue panics in     httputil.ReverseProxy bsc#1174153 CVE-2020-15586

  - go#40210 crypto/x509: Certificate.Verify method     seemingly ignoring EKU requirements on Windows     bsc#1174191 CVE-2020-14039 (Windows only)

  - Add patch to ensure /etc/hosts is used if     /etc/nsswitch.conf is not present bsc#1172868     gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues :

go1.14 was updated to version 1.14.7

CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  - go#39991 runtime: missing deferreturn on linux/ppc64le

  - go#39920 net/http: panic on misformed If-None-Match     Header with http.ServeContent

  - go#39849 cmd/compile: internal compile error when using     sync.Pool: mismatched zero/store sizes

  - go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386     fails on linux/386 in Go 1.14 and 1.13, not 1.15

  - go#39698 reflect: panic from malloc after MakeFunc     function returns value that is also stored globally

  - go#39636 reflect: DeepEqual can return true for values     that are not equal

  - go#39585 encoding/json: incorrect object key     unmarshaling when using custom TextUnmarshaler as Key     with string va lues

  - go#39562 cmd/compile/internal/ssa:
    TestNexting/dlv-dbg-hist failing on linux-386-longtest     builder because it trie s to use an older version of dlv     which only supports linux/amd64

  - go#39308 testing: streaming output loses parallel     subtest associations

  - go#39288 cmd/vet: update for new number formats

  - go#39101 database/sql: context cancellation allows     statements to execute after rollback

  - go#38030 doc: BuildNameToCertificate deprecated in go     1.14 not mentioned in the release notes

  - go#40212 net/http: Expect 100-continue panics in     httputil.ReverseProxy bsc#1174153 CVE-2020-15586

  - go#40210 crypto/x509: Certificate.Verify method     seemingly ignoring EKU requirements on Windows     bsc#1174191 CVE-2020-14039 (Windows only)

Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for go1.13 fixes the following issues :

  - go1.13.14 (released 2020/07/16) includes fixes to the     compiler, vet, and the database/sql, net/http, and     reflect packages Refs bsc#1149259 go1.13 release     tracking

  - go#39925 net/http: panic on misformed If-None-Match     Header with http.ServeContent

  - go#39848 cmd/compile: internal compile error when using     sync.Pool: mismatched zero/store sizes

  - go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386     fails on linux/386 in Go 1.14 and 1.13, not 1.15

  - go#39697 reflect: panic from malloc after MakeFunc     function returns value that is also stored globally

  - go#39561 cmd/compile/internal/ssa:
    TestNexting/dlv-dbg-hist failing on linux-386-longtest     builder because it tries to use an older version of dlv     which only supports linux/amd64

  - go#39538 net: TestDialParallel is flaky on     windows-amd64-longtest

  - go#39287 cmd/vet: update for new number formats

  - go#40211 net/http: Expect 100-continue panics in     httputil.ReverseProxy bsc#1174153 CVE-2020-15586

  - go#40209 crypto/x509: Certificate.Verify method     seemingly ignoring EKU requirements on Windows     bsc#1174191 CVE-2020-14039 (Windows only)

  - go#38932 runtime: preemption in startTemplateThread may     cause infinite hang

  - go#36689 go/types, math/big: data race in go/types due     to math/big.Rat accessors unsafe for concurrent use

  - Add patch to ensure /etc/hosts is used if     /etc/nsswitch.conf is not present bsc#1172868     gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
165046	EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2317)	Nessus	Huawei Local Security Checks	medium
165035	EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2288)	Nessus	Huawei Local Security Checks	medium
140570	openSUSE Security Update : go1.14 (openSUSE-2020-1407)	Nessus	SuSE Local Security Checks	medium
140569	openSUSE Security Update : go1.14 (openSUSE-2020-1405)	Nessus	SuSE Local Security Checks	medium
140387	SUSE SLED15 / SLES15 Security Update : go1.14 (SUSE-SU-2020:2562-1)	Nessus	SuSE Local Security Checks	medium
139020	openSUSE Security Update : go1.13 (openSUSE-2020-1095)	Nessus	SuSE Local Security Checks	medium
139015	openSUSE Security Update : go1.13 (openSUSE-2020-1087)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-14039

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium