一部のHTTP/2実装は、pingフラッドに対して脆弱であり、サービス拒否を引き起こす可能性があります。攻撃者はHTTP/2ピアに継続的にpingを送信し、ピアに応答の内部キューを作成させます。このデータを効率的にキューに入れる方法によって、CPU、メモリ、またはその両方が過剰に消費される可能性があります。（CVE-2019-9512）一部のHTTP/2実装は、リセットフラッドに対して脆弱であり、サービス拒否を引き起こす可能性があります。攻撃者は多数のストリームを開き、各ストリームで、ピアからRST_STREAMフレームのストリームを要求する無効なリクエストを送信します。ピアがRST_STREAMフレームをキューに入れる方法によって、メモリ、CPU、またはその両方が過剰に消費される可能性があります。（CVE-2019-9514）

An update of the go package has been released.

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.(CVE-2019-14809)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0060 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-14809:
    net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a hostname of google.com.

    CVE-2020-14040:
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.

    CVE-2020-28362:
    Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. A flaw was found in the math/big     package of Go's standard library that causes a denial of service. Applications written in Go that use     math/big via cryptographic packages, including crypto/rsa and crypto/x509, are vulnerable and can     potentially cause panic via a crafted certificate chain. The highest threat from this vulnerability is to     system availability.

    CVE-2020-28366:
    Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. An input validation vulnerability was     found in Go. From a generated go file (from the cgo tool), it is possible to modify symbols within that     object file and specify code. This flaw allows an attacker to create a repository that includes malicious     pre-built object files that could execute arbitrary code when downloaded and run via `go get` or `go     build` while building a Go project. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability.

    CVE-2020-28367:
    Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. An input validation vulnerability     was found in Go. If cgo is specified in a Go file, it is possible to bypass the validation of arguments to     the gcc compiler. This flaw allows an attacker to create a malicious repository that can execute arbitrary     code when downloaded and run via `go get` or `go build` while building a Go project. The highest threat     from this vulnerability is to confidentiality and integrity as well as system availability.

    CVE-2021-3114:
    In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field. A flaw     detected in golang: crypto/elliptic, in which P-224 keys as generated can return incorrect inputs,     reducing the strength of the cryptography. The highest threat from this vulnerability is confidentiality     and integrity.

    CVE-2021-27918:
    encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader     (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode,     DecodeElement, or Skip method.

    CVE-2021-31525:
    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations.

    CVE-2021-33196:
    In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic.

    CVE-2021-34558:
    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for go1.12 fixes the following issues :

Security issues fixed :

  - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that     results in unbounded memory growth (bsc#1146111).

  - CVE-2019-9514: Fixed HTTP/2 implementation that is     vulnerable to a reset flood, potentially leading to a     denial of service (bsc#1146115).

  - CVE-2019-14809: Fixed malformed hosts in URLs that leads     to authorization bypass (bsc#1146123).

Bugfixes :

  - Update to go version 1.12.9 (bsc#1141689).

  - Adding Web Assembly stuff from misc/wasm (bsc#1139210).

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.11 fixes the following issues :

Security issues fixed :

  - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that     results in unbounded memory growth (bsc#1146111).

  - CVE-2019-9514: Fixed HTTP/2 implementation that is     vulnerable to a reset flood, potentially leading to a     denial of service (bsc#1146115).

  - CVE-2019-14809: Fixed malformed hosts in URLs that leads     to authorization bypass (bsc#1146123).

Bugfixes :

  - Update to go version 1.11.13 (bsc#1141688).

This update was imported from the SUSE:SLE-15:Update update project.

- Rebase to go1.11.13

  - Security fix for CVE-2019-9512, CVE-2019-9514 and     CVE-2019-14809

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a hostname of google.com. (CVE-2019-14809)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. (CVE-2019-16276)

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

  - runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the     vulnerability, an attacker must be able to create multiple containers with a fairly specific mount     configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
    (CVE-2021-30465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
128293	Amazon Linux AMI：golang（ALAS-2019-1270）（Pingフラッド）（リセットフラッド）	Nessus	Amazon Linux Local Security Checks	2019/8/28	2024/5/1	critical
128709	Photon OS 1.0: Go PHSA-2019-1.0-0250	Nessus	PhotonOS Local Security Checks	2019/9/12	2024/4/26	critical
129791	Amazon Linux 2 : golang (ALAS-2019-1309)	Nessus	Amazon Linux Local Security Checks	2019/10/11	2024/4/18	critical
236611	Alibaba Cloud Linux 3 : 0060: go-toolset:rhel8 (ALINUX3-SA-2021:0060)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
128462	openSUSE Security Update : go1.12 (openSUSE-2019-2056) (Ping Flood) (Reset Flood)	Nessus	SuSE Local Security Checks	2019/9/3	2024/4/30	critical
128541	openSUSE Security Update : go1.11 (openSUSE-2019-2072) (Ping Flood) (Reset Flood)	Nessus	SuSE Local Security Checks	2019/9/6	2024/4/29	critical
128571	Fedora 29 : golang (2019-65db7ad6c7) (Ping Flood) (Reset Flood)	Nessus	Fedora Local Security Checks	2019/9/9	2024/4/26	critical
160873	NewStart CGSL MAIN 6.02 : docker-ce Multiple Vulnerabilities (NS-SA-2022-0056)	Nessus	NewStart CGSL Local Security Checks	2022/5/10	2023/10/27	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical