An update of the go package has been released.

在 Go 程式設計語言的實作中發現多個安全性問題，可導致拒絕服務，且 P-224 曲線實作可產生不正確的輸出。

在 Go 编程语言的实现中发现多个安全问题，这些问题可导致拒绝服务，并且 P-224 曲线实现可生成错误输出。

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data     race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a     request body and writes a response at the same     time.(CVE-2020-15586)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP     Request Smuggling.(CVE-2019-16276)

  - Go before 1.12.11 and 1.3.x before 1.13.2 can panic     upon an attempt to process network traffic containing     an invalid DSA public key. There are several attack     scenarios, such as traffic from a client to a server     that verifies client certificates.(CVE-2019-17596)

  - Go before 1.12.16 and 1.13.x before 1.13.7 (and the     crypto/cryptobyte package before     0.0.0-20200124225646-8b5121be2f68 for Go) allows     attacks on clients (resulting in a panic) via a     malformed X.509 certificate.(CVE-2020-7919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- go1.13.9へのリベース

  - CVE-2020-7919 のセキュリティ修正

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Goプログラミング言語の実装で複数のセキュリティの問題が発見されました。これにより、サービス拒否が発生したり、P-224曲線実装が不適切な出力を生成したりする可能性があります。

- Rebase to go1.13.9

  - Security fix for CVE-2020-7919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in the implementation of the Go programming language, which could result in denial of service and the P-224 curve implementation could generate incorrect outputs.

ID	名稱	產品	系列	已發布	已更新	嚴重性
136575	Photon OS 3.0: Go PHSA-2020-3.0-0087	Nessus	PhotonOS Local Security Checks	2020/5/13	2020/5/15	high
146371	Debian DSA-4848-1：golang-1.11 - 安全性更新	Nessus	Debian Local Security Checks	2021/2/10	2021/2/12	medium
146371	Debian DSA-4848-1：golang-1.11 - 安全更新	Nessus	Debian Local Security Checks	2021/2/10	2021/2/12	medium
136327	Photon OS 2.0: Go PHSA-2020-2.0-0238	Nessus	PhotonOS Local Security Checks	2020/5/5	2020/5/6	high
139134	EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-1804)	Nessus	Huawei Local Security Checks	2020/7/30	2024/2/27	high
135369	Fedora 31：golang（2020-12bc5b5597）	Nessus	Fedora Local Security Checks	2020/4/10	2024/3/19	high
146371	DebianDSA-4848-1：golang-1.11 - セキュリティ更新	Nessus	Debian Local Security Checks	2021/2/10	2021/2/12	medium
135369	Fedora 31 : golang (2020-12bc5b5597)	Nessus	Fedora Local Security Checks	2020/4/10	2024/3/19	high
136553	Photon OS 1.0: Go PHSA-2020-1.0-0292	Nessus	PhotonOS Local Security Checks	2020/5/13	2020/5/15	high
146371	Debian DSA-4848-1 : golang-1.11 - security update	Nessus	Debian Local Security Checks	2021/2/10	2021/2/12	medium

偵測

搜尋 Plugin

high

medium

medium

high

high

high

medium

high

high

medium