Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.

Multiple security issues were discovered in the implementation of the Go programming language, which could result in denial of service and the P-224 curve implementation could generate incorrect outputs.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data     race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a     request body and writes a response at the same     time.(CVE-2020-15586)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP     Request Smuggling.(CVE-2019-16276)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic     upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack     scenarios, such as traffic from a client to a server     that verifies client certificates.(CVE-2019-17596)

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the     crypto/cryptobyte package before     0.0.0-20200124225646-8b5121be2f68 for Go) allows     attacks on clients (resulting in a panic) via a     malformed X.509 certificate.(CVE-2020-7919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the go package has been released.

- Rebase to go1.13.9

  - Security fix for CVE-2020-7919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
146371	Debian DSA-4848-1 : golang-1.11 - security update	Nessus	Debian Local Security Checks	medium
139134	EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-1804)	Nessus	Huawei Local Security Checks	high
136575	Photon OS 3.0: Go PHSA-2020-3.0-0087	Nessus	PhotonOS Local Security Checks	high
136553	Photon OS 1.0: Go PHSA-2020-1.0-0292	Nessus	PhotonOS Local Security Checks	high
136327	Photon OS 2.0: Go PHSA-2020-2.0-0238	Nessus	PhotonOS Local Security Checks	high
135369	Fedora 31 : golang (2020-12bc5b5597)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-7919

high

Tenable Plugins

medium

high

high

high

high

high