The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0131 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-38297:
    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function     invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

    CVE-2021-39293:
    In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating     that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of     an incomplete fix for CVE-2021-33196.

    CVE-2021-41771:
    ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

    CVE-2021-41772:
    Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP     archive containing an invalid name or an empty filename field.

    CVE-2021-44716:
    net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the     header canonicalization cache via HTTP/2 requests.

    CVE-2021-44717:
    Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or     unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-     descriptor exhaustion.

    CVE-2022-23772:
    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption.

    CVE-2022-23773:
    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags.

    CVE-2022-23806:
    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element.

    CVE-2022-24675:
    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount     of PEM data.

    CVE-2022-24921     regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested     expression.

    CVE-2022-28327:
    The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic     via long scalar input.

    CVE-2022-29526:
    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero     flags parameter, the Faccessat function could incorrectly report that a file is accessible.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3530:01 advisory.

    * golang: Command-line arguments may overwrite global data (CVE-2021-38297)
      * golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of     CVE-2021-33196) (CVE-2021-39293)
      * golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)
      * golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)
      * golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString     (CVE-2022-23772)
      * golang: cmd/go: misinterpretation of branch names can lead to incorrect access control     (CVE-2022-23773)
      * golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
    (CVE-2021-41771)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1745 advisory.

    Red Hat OpenShift Serverless Client kn 1.22.0 provides a CLI to interact with Red Hat OpenShift Serverless     1.22.0. The kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for     non-Linux platforms.

    Security Fix(es):
    * golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)
    * golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3833-1 advisory.

  - ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
    (CVE-2021-41771)

  - Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP     archive containing an invalid name or an empty filename field. (CVE-2021-41772)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3833-1 advisory.

    Security update go1.17.3 (released 2021-11-04) (bsc#1190649).

    - CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
    - CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2891 advisory.

    Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a     denial-of-service (DoS) and information leak. CVE-2021-33196 In archive/zip, a crafted file count (in an     archive's header) can cause a NewReader or OpenReader panic. CVE-2021-36221 Go has a race condition that     can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. CVE-2021-39293 Follow-up     fix to CVE-2021-33196 CVE-2021-41771 ImportedSymbols in debug/macho (for Open or OpenFat) accesses a     Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. CVE-2021-44716 net/http     allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
    CVE-2021-44717 Go on UNIX allows write operations to an unintended file or unintended network connection     as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. For Debian 9     stretch, these problems have been fixed in version 1.8.1-1+deb9u4. We recommend that you upgrade your     golang-1.8 packages. For the detailed security status of golang-1.8 please refer to its security tracker     page at: https://security-tracker.debian.org/tracker/golang-1.8 Further information about Debian LTS     security advisories, how to apply these updates to your system and frequently asked questions can be found     at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1819 advisory.

    delve     [1.7.2-1.0.1]
    - Disable DWARF compression which has issues (Alex Burmashev)

    [1.7.2-1]
    - Rebase to 1.7.2
    - Related: rhbz#2014088

    golang     [1.17.7-1]
    - Rebase to Go 1.17.7
    - Remove fips memory leak patch (fixed in tree)
    - Resolves: rhbz#2015930

    go-toolset     [1.17.7-1]
    - Rebase to Go 1.17.7
    - Remove fips memory leak patch (fixed in tree)
    - Resolves: rhbz#2015930

    [1.17.5-1]
    - Rebase to Go 1.17.5
    - Resolves: rhbz#2031112

    [1.17.4-1]
    - Rebase Go to 1.17.4
    - Add vdso_s390x_gettime patch
    - Add remove_waitgroup_misuse_tests patch
    - Related: rhbz#2014088
    - Resolves: rhbz#2028570
    - Resolves: rhbz#2022828
    - Resolves: rhbz#2024686
    - Resolves: rhbz#2028662

    [1.17.2-1]
    - Rebase to Go 1.17.2
    - Rebase to Delve 1.7.2
    - Resolves: rhbz#2014088

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-193 advisory.

    A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating     chunked encoding. This issue could allow request smuggling, but only if combined with an intermediate     server that also improperly accepts the header as invalid. (CVE-2022-1705)

    A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go     source code, which contains deeply nested types or declarations, a panic can occur due to stack     exhaustion. This issue allows an attacker to impact system availability. (CVE-2022-1962)

    In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

    A flaw was found in golang encoding/xml. When calling Decoder.Skip while parsing a deeply nested XML     document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
    (CVE-2022-28131)

    A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large     number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to     impact availability. (CVE-2022-30630)

    A flaw was found in golang. Calling the Reader.Read method on an archive that contains a large number of     concatenated 0-length compressed files can cause a panic issue due to stack exhaustion. (CVE-2022-30631)

    A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can     cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
    (CVE-2022-30632)

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the any field tag. (CVE-2022-30633)

    A flaw was found in golang. When calling Decoder.Decode on a message that contains deeply nested     structures, a panic can occur due to stack exhaustion and allows an attacker to impact system     availability. (CVE-2022-30635)

    Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

    JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example,     JoinPath(https://go.dev, ../go) returns the URL https://go.dev/../go, despite the JoinPath     documentation stating that ../ path elements are removed from the result. (CVE-2022-32190)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-048 advisory.

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic     or potentially exhaust system memory when parsing malformed ZIP files. (CVE-2021-33196)

    A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm     GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from     the arguments. The highest threat from this vulnerability is to integrity. (CVE-2021-38297)

    An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the     debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat, it can     cause golang to attempt to read outside of a slice (array) causing a panic when calling ImportedSymbols.
    An attacker can use this vulnerability to craft a file which causes an application using this library to     crash resulting in a denial of service. (CVE-2021-41771)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where     Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can panic when parsing a crafted ZIP     archive containing completely invalid names or an empty filename argument. (CVE-2021-41772)

    There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader()     function. An attacker who submits specially crafted requests to applications linked with net/http's http2     functionality could cause excessive resource consumption that could lead to a denial of service or     otherwise impact to system performance and resources. (CVE-2021-44716)

    There's a flaw in golang's syscall.ForkExec() interface. An attacker who manages to first cause a file     descriptor exhaustion for the process, then cause syscall.ForkExec() to be called repeatedly, could     compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked with     and using syscall.ForkExec(). (CVE-2021-44717)

    A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating     chunked encoding. This issue could allow request smuggling, but only if combined with an intermediate     server that also improperly accepts the header as invalid. (CVE-2022-1705)

    A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go     source code, which contains deeply nested types or declarations, a panic can occur due to stack     exhaustion. This issue allows an attacker to impact system availability. (CVE-2022-1962)

    A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a     large PEM input (more than 5 MB) ), causing a stack overflow in Decode, which leads to a loss of     availability. (CVE-2022-24675)

    A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application     using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient     nesting depths. To exploit this vulnerability, an attacker would need to send large regexps with deep     nesting to the application. Triggering this flaw leads to a crash of the runtime, which causes a denial of     service. (CVE-2022-24921)

    A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to     fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling     an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191)

    In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

    A flaw was found in golang encoding/xml. When calling Decoder.Skip while parsing a deeply nested XML     document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
    (CVE-2022-28131)

    An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to     use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to     panic, leading to a loss of availability. (CVE-2022-28327)

    Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)

    A flaw was found in the syscall.Faccessat function when calling a process by checking the group. This flaw     allows an attacker to check the process group permissions rather than a member of the file's group,     affecting system availability. (CVE-2022-29526)

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

    A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large     number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to     impact availability. (CVE-2022-30630)

    A flaw was found in golang. Calling the Reader.Read method on an archive that contains a large number of     concatenated 0-length compressed files can cause a panic issue due to stack exhaustion. (CVE-2022-30631)

    A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can     cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
    (CVE-2022-30632)

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the any field tag. (CVE-2022-30633)

    A flaw was found in golang. When calling Decoder.Decode on a message that contains deeply nested     structures, a panic can occur due to stack exhaustion and allows an attacker to impact system     availability. (CVE-2022-30635)

    Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

    An uncontrolled resource consumption flaw was found in Golang math/big. A too-short encoded message can     cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go, potentially allowing an attacker to     create a denial of service, impacting availability. (CVE-2022-32189)

    JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example,     JoinPath(https://go.dev, ../go) returns the URL https://go.dev/../go, despite the JoinPath     documentation stating that ../ path elements are removed from the result. (CVE-2022-32190)

    Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

    Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows.
    In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not     properly checked for. A malicious environment variable value can exploit this behavior to set a value for     a different environment variable. For example, the environment variable string A=Bx00C=D sets the     variables A=B and C=D. (CVE-2022-41716)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
236557	Alibaba Cloud Linux 3 : 0131: go-toolset:rhel8 (ALINUX3-SA-2022:0131)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
294331	MiracleLinux 8 : go-toolset:rhel8 (AXSA:2022-3530:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	critical
251013	Linux Distros Unpatched Vulnerability : CVE-2021-41771	Nessus	Misc.	2025/8/18	2026/11/5	high
194207	RHEL 8 : Release of OpenShift Serverless Client kn 1.22.0 (Low) (RHSA-2022:1745)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	high
155777	openSUSE 15 Security Update : go1.17 (openSUSE-SU-2021:3833-1)	Nessus	SuSE Local Security Checks	2021/12/2	2021/12/2	high
155813	SUSE SLED15 / SLES15 Security Update : go1.17 (SUSE-SU-2021:3833-1)	Nessus	SuSE Local Security Checks	2021/12/2	2026/6/25	high
156954	Debian DLA-2891-1 : golang-1.8 - LTS security update	Nessus	Debian Local Security Checks	2022/1/22	2025/1/24	medium
161286	Oracle Linux 8 : go-toolset:ol8 (ELSA-2022-1819)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/11/2	critical
204385	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0419	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/11/2	critical
166999	Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2022-193)	Nessus	Amazon Linux Local Security Checks	2022/11/4	2024/12/11	critical
173069	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-048)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2025/9/11	critical

検出

プラグインの検索

critical

critical

high

high

high

high

medium

critical

critical

critical

critical