An update of the go package has been released.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Go 版本 1.15 及更早版本中的 encoding/xml 程序包在标记化循环期间未正确保留指令语义，这允许攻击者在受影响下游应用程序的不同处理阶段期间以冲突的方式行事的输入。
    (CVE-2020-29510)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

According to the versions of the golang packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection. (CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the kubernetes package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing in affected downstream applications.
    (CVE-2020-29510)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Go 1.15 版和更舊版本中的編碼/xml 套件在 token 化來回行程期間未正確保留指示詞的語意，進而允許攻擊者特製輸入，在受影響的下游應用程式的不同處理階段期間以沖突的方式行事。
    (CVE-2020-29510)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - バージョン 1.15 以前の Encoding/xml パッケージは、トークン化のラウンドトリップ中にディレクティブのセマンティクスを適切に保存しません。これにより、攻撃者は、影響を受けるダウンストリームアプリケーションの処理のさまざまな段階で、競合する方法で動作する入力を細工することができます。
    (CVE-2020-29510)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

ID	名稱	產品	系列	已發布	已更新	嚴重性
150285	Photon OS 3.0: Go PHSA-2021-3.0-0248	Nessus	PhotonOS Local Security Checks	2021/6/4	2025/8/22	medium
148062	EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-1678)	Nessus	Huawei Local Security Checks	2021/3/24	2022/5/10	high
144686	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1006)	Nessus	Huawei Local Security Checks	2021/1/4	2022/5/11	high
229875	Linux Distros 未修补的漏洞: CVE-2020-29510	Nessus	Misc.	2025/3/5	2025/8/18	medium
147555	EulerOS Virtualization 3.0.6.6 : golang (EulerOS-SA-2021-1480)	Nessus	Huawei Local Security Checks	2021/3/10	2022/5/10	high
204385	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0419	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
144699	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1025)	Nessus	Huawei Local Security Checks	2021/1/4	2022/5/11	high
229875	Linux Distros Unpatched Vulnerability : CVE-2020-29510	Nessus	Misc.	2025/3/5	2025/8/18	medium
229875	Linux Distros 未修補弱點：CVE-2020-29510	Nessus	Misc.	2025/3/5	2025/8/18	medium
229875	Linux Distros のパッチ未適用の脆弱性: CVE-2020-29510	Nessus	Misc.	2025/3/5	2025/8/18	medium

偵測

搜尋 Plugin

medium

high

high

medium

high

critical

high

medium

medium

medium