The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5729 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.25. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2022:5730

    Security Fix(es):

    * golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)
    * golang: regexp: stack exhaustion via a deeply nested expression     (CVE-2022-24921)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.10 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1819 advisory.

    delve     [1.7.2-1.0.1]
    - Disable DWARF compression which has issues (Alex Burmashev)

    [1.7.2-1]
    - Rebase to 1.7.2
    - Related: rhbz#2014088

    golang     [1.17.7-1]
    - Rebase to Go 1.17.7
    - Remove fips memory leak patch (fixed in tree)
    - Resolves: rhbz#2015930

    go-toolset     [1.17.7-1]
    - Rebase to Go 1.17.7
    - Remove fips memory leak patch (fixed in tree)
    - Resolves: rhbz#2015930

    [1.17.5-1]
    - Rebase to Go 1.17.5
    - Resolves: rhbz#2031112

    [1.17.4-1]
    - Rebase Go to 1.17.4
    - Add vdso_s390x_gettime patch
    - Add remove_waitgroup_misuse_tests patch
    - Related: rhbz#2014088
    - Resolves: rhbz#2028570
    - Resolves: rhbz#2022828
    - Resolves: rhbz#2024686
    - Resolves: rhbz#2028662

    [1.17.2-1]
    - Rebase to Go 1.17.2
    - Rebase to Delve 1.7.2
    - Resolves: rhbz#2014088

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 096ab080-907c-11ec-bb14-002324b2fba8 advisory.

  - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

  - Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0724-1 advisory.

  - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

  - Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0723-1 advisory.

  - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

  - Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang / python-tensorboard installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-23773 advisory.

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of golang installed on the remote host is prior to 1.16.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1811 advisory.

    An infinite loop vulnerability was found in golang. If an application defines a custom token parser     initializing with `xml.NewTokenDecoder` it is possible for the parsing loop to never return. An attacker     could potentially craft a malicious XML document which has an XML element with `EOF` within it, causing     the parsing application to endlessly loop, resulting in a Denial of Service (DoS). (CVE-2021-27918)

    archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon     attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any     filename. (CVE-2021-27919)

    A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the     net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing     injection of unexpected contents. The highest threat from this vulnerability is to integrity.
    (CVE-2021-33195)

    A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards     connection headers if the first one was empty. This flaw allows an attacker to drop arbitrary headers. The     highest threat from this vulnerability is to integrity. (CVE-2021-33197)

    A flaw was found in Go, where it attempts to allocate excessive memory. This issue may cause panic or     unrecoverable fatal error if passed inputs with very large exponents. The highest threat from this     vulnerability is to system availability. (CVE-2021-33198)

    A race condition flaw was found in Go. The incoming requests body weren't closed after the handler panic     and as a consequence this could lead to ReverseProxy crash.  The highest threat from this vulnerability is     to Availability. (CVE-2021-36221)

    A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm     GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from     the arguments. The highest threat from this vulnerability is to integrity. (CVE-2021-38297)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic     or potentially exhaust system memory when parsing malformed ZIP files. An attacker capable of submitting a     crafted ZIP file to a Go application using archive/zip to process that file could cause a denial of     service via memory exhaustion or panic. This particular flaw is an incomplete fix for a previous flaw.
    (CVE-2021-39293)

    An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the     debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat, it can     cause golang to attempt to read outside of a slice (array) causing a panic when calling ImportedSymbols.
    An attacker can use this vulnerability to craft a file which causes an application using this library to     crash resulting in a denial of service. (CVE-2021-41771)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where     Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can panic when parsing a crafted ZIP     archive containing completely invalid names or an empty filename argument. (CVE-2021-41772)

    There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader()     function. An attacker who submits specially crafted requests to applications linked with net/http's http2     functionality could cause excessive resource consumption that could lead to a denial of service or     otherwise impact to system performance and resources. (CVE-2021-44716)

    There's a flaw in golang's syscall.ForkExec() interface. An attacker who manages to first cause a file     descriptor exhaustion for the process, then cause syscall.ForkExec() to be called repeatedly, could     compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked with     and using syscall.ForkExec(). (CVE-2021-44717)

    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

    A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application     using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient     nesting depths. To exploit this vulnerability, an attacker would need to send large regexps with deep     nesting to the application. Triggering this flaw leads to a crash of the runtime, which causes a denial of     service. (CVE-2022-24921)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
164871	RHEL 7 / 8 : OpenShift Container Platform 4.10.25 (RHSA-2022:5729)	Nessus	Red Hat Local Security Checks	2022/9/8	2024/11/7	critical
161286	Oracle Linux 8 : go-toolset:ol8 (ELSA-2022-1819)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/11/2	critical
158143	FreeBSD : go -- multiple vulnerabilities (096ab080-907c-11ec-bb14-002324b2fba8)	Nessus	FreeBSD Local Security Checks	2022/2/18	2023/11/8	critical
158595	SUSE SLED15 / SLES15 Security Update : go1.16 (SUSE-SU-2022:0724-1)	Nessus	SuSE Local Security Checks	2022/3/5	2023/7/14	critical
158596	SUSE SLED15 / SLES15 Security Update : go1.17 (SUSE-SU-2022:0723-1)	Nessus	SuSE Local Security Checks	2022/3/5	2023/7/14	critical
206354	CBL Mariner 2.0 Security Update: golang / python-tensorboard (CVE-2022-23773)	Nessus	MarinerOS Local Security Checks	2024/8/30	2025/2/10	high
251011	Linux Distros Unpatched Vulnerability : CVE-2022-23773	Nessus	Misc.	2025/8/18	2025/8/18	high
163229	Amazon Linux 2 : golang (ALAS-2022-1811)	Nessus	Amazon Linux Local Security Checks	2022/7/15	2025/4/11	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

high

high

critical