An update of the go package has been released.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - go: encoding/xml: XML element instability (CVE-2020-29511)

  - The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. (CVE-2020-14040)

  - The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute     namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave     in conflicting ways during different stages of processing in affected downstream applications.
    (CVE-2020-29509)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the kubernetes package has been released.

According to the versions of the golang packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection. (CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - golang: crypto/elliptic implementations of P-521 and P-384 elliptic curves allow for denial of service     (CVE-2019-6486)

  - go: encoding/xml: XML element instability (CVE-2020-29511)

  - The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. (CVE-2020-14040)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
150285	Photon OS 3.0: Go PHSA-2021-3.0-0248	Nessus	PhotonOS Local Security Checks	6/4/2021	7/24/2024	medium
144699	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1025)	Nessus	Huawei Local Security Checks	1/4/2021	5/11/2022	high
202277	RHEL 7 : golang (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	7/12/2024	7/12/2024	medium
148062	EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-1678)	Nessus	Huawei Local Security Checks	3/24/2021	5/10/2022	high
144686	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1006)	Nessus	Huawei Local Security Checks	1/4/2021	5/11/2022	high
204385	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0419	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
147555	EulerOS Virtualization 3.0.6.6 : golang (EulerOS-SA-2021-1480)	Nessus	Huawei Local Security Checks	3/10/2021	5/10/2022	high
202282	RHEL 8 : golang (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	7/12/2024	7/12/2024	high

Detections

Analytics

Plugins Search

medium

high

medium

high

high

critical

high

high