An update of the go package has been released.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7766 advisory.

    The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-     ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI     concerns itself only with network connectivity of containers and removing allocated resources when the     container is deleted.

    Security Fix(es):

    * golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

    * golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7764 advisory.

  - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

  - The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

  - Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)

  - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake     messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now     consistently reject messages larger than 65KiB in size. (CVE-2023-39322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang Go installed on the remote host is affected by multiple vulnerabilities, including the following:

  - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages,     allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject     messages larger than 65KiB in size. (CVE-2023-39322)

  - Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)

  - The html/template package does not properly handle HTML-like double quote comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script>     contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack. (CVE-2023-39318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0121 advisory.

    * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    * golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

    * golang: html/template:  improper handling of HTML-like comments within script contexts (CVE-2023-39318)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6574-1 advisory.

    Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context     of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a     cross site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and     Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319)

    It was discovered that Go did not properly validate the //go:cgo_ directives during compilation. An     attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323)

    It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the     net/http module. An attacker could possibly use this issue to cause a panic resulting into a denial of     service. (CVE-2023-39325, CVE-2023-44487)

    It was discovered that the Go net/http module did not properly validate the chunk extensions reading from     a request or response body. An attacker could possibly use this issue to read sensitive information.
    (CVE-2023-39326)

    It was discovered that Go did not properly validate the insecure git:// protocol when using go get to     fetch a module with the .git suffix. An attacker could possibly use this issue to bypass secure protocol     checks. (CVE-2023-45285)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - The html/template package does not properly handle HTML-like '' comment tokens, nor hashbang '#!' comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of '<script', '<!--',     and '</script' within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

  - Line directives ('//line') can be used to bypass the restrictions on '//go:cgo_' directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running 'go build'. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex. (CVE-2023-39323)

  - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function. (CVE-2023-39325)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5009 advisory.

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE:
    the vendor and discoverer indicate that this is not a security issue. (CVE-2023-29824)

  - A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when     FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. (CVE-2023-3089)

  - A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This     issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and     properly configured. (CVE-2023-3153)

  - goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via     unspecified vectors. (CVE-2023-37788)

  - The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

  - Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)

  - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake     messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now     consistently reject messages larger than 65KiB in size. (CVE-2023-39322)

  - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function. (CVE-2023-39325)

  - Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be     escaped to not be. This could lead to an XSS attack. (CVE-2023-3978)

  - golang: net/http, x/net/http2: rapid stream resets can cause excessive work () (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.20.8-1.47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1848 advisory.

    2024-01-03: CVE-2023-24537 was added to this advisory.

    2024-01-03: CVE-2023-29400 was added to this advisory.

    2024-01-03: CVE-2023-24538 was added to this advisory.

    2024-01-03: CVE-2022-41722 was added to this advisory.

    2024-01-03: CVE-2022-41717 was added to this advisory.

    2024-01-03: CVE-2023-24540 was added to this advisory.

    2024-01-03: CVE-2022-41724 was added to this advisory.

    2024-01-03: CVE-2023-24532 was added to this advisory.

    2024-01-03: CVE-2023-39319 was added to this advisory.

    2024-01-03: CVE-2022-41725 was added to this advisory.

    2024-01-03: CVE-2023-29404 was added to this advisory.

    2024-01-03: CVE-2023-29405 was added to this advisory.

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

    The Go project has described this issue as follows:

    On Windows, the filepath.Clean function could transform an invalid path such as a/../c:/b into the valid     path c:\b. This transformation of a relative (if invalid) path into an absolute path could enable a     directory traversal attack. The filepath.Clean function will now transform this path into the relative     (but still invalid) path .\c:\b. (CVE-2022-41722)

    Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

    Golang: net/http, mime/multipart: denial of service from excessive resource consumption     (https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E) (CVE-2022-41725)

    The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with     some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages     of crypto/ecdsa or crypto/ecdh. (CVE-2023-24532)

    Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow. (CVE-2023-24537)

    Templates did not properly consider backticks (`) as Javascript string delimiters, and as such didnot     escape them as expected. Backticks are used, since ES6, for JS template literals. If a templatecontained a     Go template action within a Javascript template literal, the contents of the action couldbe used to     terminate the literal, injecting arbitrary Javascript code into the Go template. (CVE-2023-24538)

    html/template: improper handling of JavaScript whitespace.

    Not all valid JavaScript whitespace characters were considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

    html/template: improper handling of empty HTML attributes.

    Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input     could result in output that would have unexpected results when parsed due to HTML normalization rules.
    This may allow injection of arbitrary attributes into tags. (CVE-2023-29400)

    On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid     bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of     standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors     closed, opening any files can result in unexpected content being read or written with elevated privileges.
    Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents     of its registers. (CVE-2023-29403)

    The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. The arguments for a number of flags     which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled     through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. (CVE-2023-29404)

    The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

    The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

    Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

    The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0101 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2018-25091:
    urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect     (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the     authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue     exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

    CVE-2021-33198:
    In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method.

    CVE-2021-34558:
    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic.

    CVE-2022-2879:
    Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

    CVE-2022-2880:
    Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged.

    CVE-2022-41715:
    Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected.

    CVE-2023-29409:
    Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable.

    CVE-2023-39318:
    The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack.

    CVE-2023-39319:
    The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack.

    CVE-2023-39321:
    Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

    CVE-2023-39322:
    QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake     messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now     consistently reject messages larger than 65KiB in size.

    CVE-2023-39326:
    A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response     body to read many more bytes from the network than are in the body. A malicious HTTP client can further     exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a     handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which     permit including additional metadata in a request or response body sent using the chunked encoding. The     net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large     metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real     body to encoded bytes grows too small.

    CVE-2023-45287:
    Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA     blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective.
    In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn     could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant     time RSA implementation, which we do not believe exhibits any timing side channels.

    CVE-2023-45803:
    urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body.

    CVE-2023-48795:
    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust.

    CVE-2024-1753:
    A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary     locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image     with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the     host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write     access to the host filesystem, allowing for full container escape at build time.

    CVE-2024-23650:
    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to     BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using     BuildKit frontends from untrusted sources.

    CVE-2024-24786:
    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set.

    CVE-2024-28180:
    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
204658	Photon OS 3.0: Go PHSA-2023-3.0-0665	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
186797	RHEL 9 : containernetworking-plugins (RHSA-2023:7766)	Nessus	Red Hat Local Security Checks	2023/12/12	2025/3/6	medium
186946	AlmaLinux 9 : buildah (ALSA-2023:7764)	Nessus	Alma Linux Local Security Checks	2023/12/15	2023/12/15	medium
181472	Golang < 1.20.8 / 1.21.x < 1.21.1 Multiple Vulnerabilities	Nessus	Windows	2023/9/15	2023/12/8	medium
235537	RockyLinux 8 : container-tools:4.0 (RLSA-2024:0121)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	high
187937	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Go vulnerabilities (USN-6574-1)	Nessus	Ubuntu Local Security Checks	2024/1/11	2024/9/18	critical
188866	EulerOS 2.0 SP9 : golang (EulerOS-SA-2023-3331)	Nessus	Huawei Local Security Checks	2024/1/16	2024/2/9	high
189423	RHCOS 4 : OpenShift Container Platform 4.14.0 (RHSA-2023:5009)	Nessus	Red Hat Local Security Checks	2024/1/24	2024/2/9	critical
182699	Amazon Linux AMI : golang (ALAS-2023-1848)	Nessus	Amazon Linux Local Security Checks	2023/10/6	2024/12/11	critical
236311	Alibaba Cloud Linux 3 : 0101: container-tools:rhel8 (ALINUX3-SA-2024:0101)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical

偵測

搜尋 Plugin

medium

medium

medium

medium

high

critical

high

critical

critical

critical