Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335411);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/28");

  script_cve_id(
    "CVE-2026-33818",
    "CVE-2026-39821",
    "CVE-2026-56853",
    "CVE-2026-56858",
    "CVE-2026-56859",
    "CVE-2026-56860",
    "CVE-2026-56862",
    "CVE-2026-56864",
    "CVE-2026-56865"
  );
  script_xref(name:"IAVB", value:"2026-B-0234");

  script_name(english:"Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Golang running on the remote host is 1.25.x prior to 1.25.13, or 1.26.x prior to 1.26.6. It is,
therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the
golang-announce advisory.

  - The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an
    ASCII-only label. This can lead to privilege escalation in programs using the idna package.
    (CVE-2026-39821)

  - When a server is configured to support unencrypted HTTP/2, it reads bytes from each new connection
    to check for the HTTP/2 client preface. Previously this was done with no timeout. ReadHeaderTimeout
    is now applied for this check. (CVE-2026-56853)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://groups.google.com/g/golang-announce/c/94pEornpRlI
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3e20b36a");
  script_set_attribute(attribute:"see_also", value:"https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Golang Go version 1.25.13, 1.26.6, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-39821");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-56865");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:golang:go");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("golang_win_installed.nbin", "golang_macos_installed.nbin");
  script_require_keys("installed_sw/Golang Go Programming Language");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Golang Go Programming Language', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '1.25.0', 'fixed_version': '1.25.13'},
        {'min_version': '1.26.0', 'fixed_version': '1.26.6'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);