Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Go vulnerabilities (USN-8935-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8935-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(367749);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id(
    "CVE-2026-33818",
    "CVE-2026-56859",
    "CVE-2026-56862",
    "CVE-2026-56865",
    "CVE-2026-56866",
    "CVE-2026-78659",
    "CVE-2026-78660",
    "CVE-2026-78663",
    "CVE-2026-78667",
    "CVE-2026-78669",
    "CVE-2026-94439",
    "CVE-2026-94440"
  );
  script_xref(name:"USN", value:"8935-1");

  script_name(english:"Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Go vulnerabilities (USN-8935-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple
vulnerabilities as referenced in the USN-8935-1 advisory.

    It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1
    structures. An attacker could possibly use this issue to cause Go to crash, resulting in a denial of
    service. (CVE-2026-33818)

    It was discovered that Go incorrectly reset the depth counter when decoding XML elements. An attacker
    could possibly use this issue to cause Go to crash via deeply nested XML input, resulting in a denial of
    service. (CVE-2026-56859)

    It was discovered that Go incorrectly handled TLS KeyUpdate messages after the handshake was completed. A
    remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial
    of service. (CVE-2026-56862)

    It was discovered that Go did not correctly verify checksum database tiles against their parents. An
    attacker in control of a malicious module proxy could possibly use this issue to bypass checksum database
    verification and serve malicious module content. (CVE-2026-56865)

    It was discovered that the Go HTTP client incorrectly returned connections to the idle pool after a
    rejected HTTP/1 CONNECT request with a request body. A remote attacker could possibly use this issue to
    perform HTTP response poisoning attacks against reverse proxies. (CVE-2026-56866)

    It was discovered that the Go HTTP/2 server did not apply header limits to Trailer headers. A remote
    attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of
    service. (CVE-2026-78659)

    It was discovered that the Go HTTP/2 implementation did not remove malformed framing-related headers when
    forwarding responses. A remote attacker could possibly use this issue to perform HTTP response smuggling
    attacks when Go was acting as a reverse proxy. (CVE-2026-78660)

    It was discovered that the Go HTTP/2 server could refund connection-level flow control twice for the same
    data under certain circumstances. A remote attacker could possibly use this issue to bypass the configured
    connection-level flow control limit. (CVE-2026-78663)

    It was discovered that Go did not limit the size of Range headers parsed when serving content over HTTP. A
    remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial
    of service. (CVE-2026-78667)

    It was discovered that the Go HTTP/2 implementation incorrectly handled SETTINGS frames that changed the
    initial window size. A remote attacker could possibly use this issue to cause Go to use excessive
    resources, leading to a denial of service. (CVE-2026-78669)

    It was discovered that the Go HTTP server continued to serve requests on a connection after sending a
    successful response to an HTTP/1 CONNECT request. A remote attacker could possibly use this issue to
    perform HTTP request smuggling attacks. (CVE-2026-94439)

    It was discovered that Go did not enforce memory limits on the first line of a part when parsing multipart
    forms. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to
    a denial of service. (CVE-2026-94440)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8935-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected golang-1.22, golang-1.22-go and / or golang-1.22-src packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78663");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:golang-1.22");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:golang-1.22-go");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:golang-1.22-src");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('20.04' >< os_release || '22.04' >< os_release || '24.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 20.04 / 22.04 / 24.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '20.04', 'pkgname': 'golang-1.22', 'pkgver': '1.22.2-2~20.04.3'},
    {'osver': '20.04', 'pkgname': 'golang-1.22-go', 'pkgver': '1.22.2-2~20.04.3'},
    {'osver': '20.04', 'pkgname': 'golang-1.22-src', 'pkgver': '1.22.2-2~20.04.3'},
    {'osver': '22.04', 'pkgname': 'golang-1.22', 'pkgver': '1.22.2-2~22.04.4'},
    {'osver': '22.04', 'pkgname': 'golang-1.22-go', 'pkgver': '1.22.2-2~22.04.4'},
    {'osver': '22.04', 'pkgname': 'golang-1.22-src', 'pkgver': '1.22.2-2~22.04.4'},
    {'osver': '24.04', 'pkgname': 'golang-1.22', 'pkgver': '1.22.2-2ubuntu0.5'},
    {'osver': '24.04', 'pkgname': 'golang-1.22-go', 'pkgver': '1.22.2-2ubuntu0.5'},
    {'osver': '24.04', 'pkgname': 'golang-1.22-src', 'pkgver': '1.22.2-2ubuntu0.5'}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = '';
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'golang-1.22 / golang-1.22-go / golang-1.22-src');
}