Golang 1.26.x < 1.26.9 / 1.27.x < 1.27.2 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366456);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/19");

  script_cve_id(
    "CVE-2026-56857",
    "CVE-2026-56866",
    "CVE-2026-78659",
    "CVE-2026-78660",
    "CVE-2026-78663",
    "CVE-2026-78667",
    "CVE-2026-78669",
    "CVE-2026-94439",
    "CVE-2026-94440",
    "CVE-2026-94444",
    "CVE-2026-94447",
    "CVE-2026-94448",
    "CVE-2026-97030",
    "CVE-2026-97031",
    "CVE-2026-97032"
  );
  script_xref(name:"IAVB", value:"2026-B-0296");

  script_name(english:"Golang 1.26.x < 1.26.9 / 1.27.x < 1.27.2 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Golang running on the remote host is 1.26.x prior to 1.26.9, or 1.27.x prior to 1.27.2. It is,
therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the
golang-announce advisory, including:

  - On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the
    operation can create a directory at the junction target even when that target is located outside the root. This
    only applies to operations where the last path component is a junction (path/to/junction, but not
    path/junction/target). (CVE-2026-56857)

  - The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a
    stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the
    buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit
    (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and
    stream-level flow control. (CVE-2026-78663)

  - When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to
    the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx
    keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a
    request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the
    connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the
    response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT
    requests through a shared Transport, this can lead to cross-user response poisoning. (CVE-2026-56866)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI");
  script_set_attribute(attribute:"see_also", value:"https://www.openwall.com/lists/oss-security/2026/10/08/9");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Golang Go version 1.26.9, 1.27.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56857");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:golang:go");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("golang_win_installed.nbin", "golang_macos_installed.nbin");
  script_require_keys("installed_sw/Golang Go Programming Language");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Golang Go Programming Language', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '1.26.0', 'fixed_version': '1.26.9'},
        {'min_version': '1.27.0', 'fixed_version': '1.27.2'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, flags:{"xss":TRUE});
vdf::handle_check_and_report_errors(vdf_result:result);