SUSE SLED15 / SLES15 Security Update : go1.14 (SUSE-SU-2020:2562-1)

medium Nessus Plugin ID 140387

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

This update for go1.14 fixes the following issues :

go1.14 was updated to version 1.14.7

CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

- go#39991 runtime: missing deferreturn on linux/ppc64le

- go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent

- go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes

- go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15

- go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally

- go#39636 reflect: DeepEqual can return true for values that are not equal

- go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues

- go#39562 cmd/compile/internal/ssa:
TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64

- go#39308 testing: streaming output loses parallel subtest associations

- go#39288 cmd/vet: update for new number formats

- go#39101 database/sql: context cancellation allows statements to execute after rollback

- go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes

- go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586

- go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Development Tools 15-SP2 :

zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2020-2562=1

SUSE Linux Enterprise Module for Development Tools 15-SP1 :

zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP1-2020-2562=1

Plugin Details

Severity: Medium

ID: 140387

File Name: suse_SU-2020-2562-1.nasl

Version: 1.5

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 9/8/2020

Updated: 12/4/2020

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2020-14039

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:go1.14-doc, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:go1.14

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 9/7/2020

Vulnerability Publication Date: 7/17/2020

Reference Information

CVE: CVE-2020-14039, CVE-2020-15586, CVE-2020-16845

IAVB: 2020-B-0060-S

Detections

Analytics