(RHSA-2017:3463) Moderate: go-toolset-7 and go-toolset-7-golang security and bug fix update
2017-12-14T16:22:18
ID RHSA-2017:3463 Type redhat Reporter RedHat Modified 2017-12-14T16:24:18
Description
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side. (CVE-2017-15041)
It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement properly. A remote man-in-the-middle attacker could potentially use this flaw to sniff SMTP credentials sent by a Go application. (CVE-2017-15042)
Bug Fix(es):
Previously, the enable script for the go-toolset-7 Software Collection incorrectly set the GOPATH environment variable to a directory that required root permissions for write operations. As a consequence, the go compiler terminated unexpectedly when performing certain commands. The enable script has been changed to handle GOPATH correctly, and the described problem no longer occurs. (BZ#1512013)
{"cve": [{"lastseen": "2020-12-09T20:13:24", "description": "An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.", "edition": 6, "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.9, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2017-10-05T21:29:00", "title": "CVE-2017-15042", "type": "cve", "cwe": ["CWE-319"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15042"], "modified": "2019-10-03T00:03:00", "cpe": ["cpe:/a:golang:go:1.9", "cpe:/a:golang:go:1.8.3"], "id": "CVE-2017-15042", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15042", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:golang:go:1.9:*:*:*:*:*:*:*", "cpe:2.3:a:golang:go:1.8.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:13:24", "description": "Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-10-05T21:29:00", "title": "CVE-2017-15041", "type": "cve", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15041"], "modified": "2019-10-03T00:03:00", "cpe": ["cpe:/a:golang:go:1.9", "cpe:/a:golang:go:1.8.3"], "id": "CVE-2017-15041", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15041", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:golang:go:1.9:*:*:*:*:*:*:*", "cpe:2.3:a:golang:go:1.8.3:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2021-01-07T10:11:32", "description": "Security fix for CVE-2017-15041 and CVE-2017-15042\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 20, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-10-18T00:00:00", "title": "Fedora 26 : golang (2017-6f1b90dbb7)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "modified": "2017-10-18T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:golang", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-6F1B90DBB7.NASL", "href": "https://www.tenable.com/plugins/nessus/103899", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-6f1b90dbb7.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(103899);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_xref(name:\"FEDORA\", value:\"2017-6f1b90dbb7\");\n\n script_name(english:\"Fedora 26 : golang (2017-6f1b90dbb7)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2017-15041 and CVE-2017-15042\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-6f1b90dbb7\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected golang package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:golang\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/10/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/10/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"golang-1.8.4-1.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T05:09:09", "description": "An update for go-toolset-7 and go-toolset-7-golang is now available\nfor Red Hat Developer Tools.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nGo Toolset provides the Go programming language tools and libraries.\nGo is alternatively known as golang.\n\nSecurity Fix(es) :\n\n* An arbitrary command execution flaw was found in the way Go's 'go\nget' command handled the checkout of source code repositories. A\nremote attacker capable of hosting malicious repositories could\npotentially use this flaw to cause arbitrary command execution on the\nclient side. (CVE-2017-15041)\n\n* It was found that smtp.PlainAuth authentication scheme in Go did not\nverify the TLS requirement properly. A remote man-in-the-middle\nattacker could potentially use this flaw to sniff SMTP credentials\nsent by a Go application. (CVE-2017-15042)\n\nBug Fix(es) :\n\n* Previously, the enable script for the go-toolset-7 Software\nCollection incorrectly set the GOPATH environment variable to a\ndirectory that required root permissions for write operations. As a\nconsequence, the go compiler terminated unexpectedly when performing\ncertain commands. The enable script has been changed to handle GOPATH\ncorrectly, and the described problem no longer occurs. (BZ#1512013)", "edition": 26, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-12-19T00:00:00", "title": "RHEL 7 : go-toolset-7 and go-toolset-7-golang (RHSA-2017:3463)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:go-toolset-7-runtime", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-dockerfiles", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-build", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-docs", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-src", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-scldevel", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-tests", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-bin", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-misc", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7", "p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-race"], "id": "REDHAT-RHSA-2017-3463.NASL", "href": "https://www.tenable.com/plugins/nessus/105367", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2017:3463. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105367);\n script_version(\"3.8\");\n script_cvs_date(\"Date: 2019/10/24 15:35:44\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_xref(name:\"RHSA\", value:\"2017:3463\");\n\n script_name(english:\"RHEL 7 : go-toolset-7 and go-toolset-7-golang (RHSA-2017:3463)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for go-toolset-7 and go-toolset-7-golang is now available\nfor Red Hat Developer Tools.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nGo Toolset provides the Go programming language tools and libraries.\nGo is alternatively known as golang.\n\nSecurity Fix(es) :\n\n* An arbitrary command execution flaw was found in the way Go's 'go\nget' command handled the checkout of source code repositories. A\nremote attacker capable of hosting malicious repositories could\npotentially use this flaw to cause arbitrary command execution on the\nclient side. (CVE-2017-15041)\n\n* It was found that smtp.PlainAuth authentication scheme in Go did not\nverify the TLS requirement properly. A remote man-in-the-middle\nattacker could potentially use this flaw to sniff SMTP credentials\nsent by a Go application. (CVE-2017-15042)\n\nBug Fix(es) :\n\n* Previously, the enable script for the go-toolset-7 Software\nCollection incorrectly set the GOPATH environment variable to a\ndirectory that required root permissions for write operations. As a\nconsequence, the go compiler terminated unexpectedly when performing\ncertain commands. The enable script has been changed to handle GOPATH\ncorrectly, and the described problem no longer occurs. (BZ#1512013)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2017:3463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15041\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15042\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-dockerfiles\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-race\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-src\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-golang-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-runtime\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:go-toolset-7-scldevel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2017:3463\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL7\", cpu:\"aarch64\", reference:\"go-toolset-7-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"go-toolset-7-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"aarch64\", reference:\"go-toolset-7-build-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"go-toolset-7-build-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-build-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"aarch64\", reference:\"go-toolset-7-dockerfiles-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"go-toolset-7-dockerfiles-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-dockerfiles-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"aarch64\", reference:\"go-toolset-7-golang-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"go-toolset-7-golang-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-golang-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"aarch64\", reference:\"go-toolset-7-golang-bin-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"go-toolset-7-golang-bin-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-golang-bin-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"go-toolset-7-golang-docs-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"go-toolset-7-golang-misc-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-golang-race-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"go-toolset-7-golang-src-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"go-toolset-7-golang-tests-1.8.5-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"aarch64\", reference:\"go-toolset-7-runtime-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"go-toolset-7-runtime-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-runtime-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"aarch64\", reference:\"go-toolset-7-scldevel-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"go-toolset-7-scldevel-1.8-10.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"go-toolset-7-scldevel-1.8-10.el7\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"go-toolset-7 / go-toolset-7-build / go-toolset-7-dockerfiles / etc\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T10:11:51", "description": "Security fix for CVE-2017-15041 and CVE-2017-15042\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 20, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-10-20T00:00:00", "title": "Fedora 25 : golang (2017-8f7bca960b)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "modified": "2017-10-20T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:25", "p-cpe:/a:fedoraproject:fedora:golang"], "id": "FEDORA_2017-8F7BCA960B.NASL", "href": "https://www.tenable.com/plugins/nessus/103997", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-8f7bca960b.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(103997);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_xref(name:\"FEDORA\", value:\"2017-8f7bca960b\");\n\n script_name(english:\"Fedora 25 : golang (2017-8f7bca960b)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2017-15041 and CVE-2017-15042\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-8f7bca960b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected golang package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:golang\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:25\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/10/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/10/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^25([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 25\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC25\", reference:\"golang-1.7.6-3.fc25\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-12T11:06:40", "description": "The remote host is affected by the vulnerability described in GLSA-201710-23\n(Go: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Go. Please review the\n references below for details.\n \nImpact :\n\n Remote attackers could execute arbitrary Go commands or conduct a man in\n the middle attack.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 26, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-10-23T00:00:00", "title": "GLSA-201710-23 : Go: Multiple vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "modified": "2017-10-23T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:go"], "id": "GENTOO_GLSA-201710-23.NASL", "href": "https://www.tenable.com/plugins/nessus/104066", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201710-23.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(104066);\n script_version(\"3.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_xref(name:\"GLSA\", value:\"201710-23\");\n\n script_name(english:\"GLSA-201710-23 : Go: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201710-23\n(Go: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Go. Please review the\n references below for details.\n \nImpact :\n\n Remote attackers could execute arbitrary Go commands or conduct a man in\n the middle attack.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201710-23\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Go users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-lang/go-1.9.1'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:go\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/10/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/10/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"dev-lang/go\", unaffected:make_list(\"ge 1.9.1\"), vulnerable:make_list(\"lt 1.9.1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Go\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T10:15:00", "description": "Security fix for CVE-2017-15041 and CVE-2017-15042\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 17, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-01-15T00:00:00", "title": "Fedora 27 : golang (2017-f4fc897e8f)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "modified": "2018-01-15T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:27", "p-cpe:/a:fedoraproject:fedora:golang"], "id": "FEDORA_2017-F4FC897E8F.NASL", "href": "https://www.tenable.com/plugins/nessus/106006", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-f4fc897e8f.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(106006);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_xref(name:\"FEDORA\", value:\"2017-f4fc897e8f\");\n\n script_name(english:\"Fedora 27 : golang (2017-f4fc897e8f)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2017-15041 and CVE-2017-15042\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-f4fc897e8f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected golang package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:golang\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/10/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"golang-1.9.1-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T01:19:42", "description": "Arbitrary code execution during go get or go get -d :\n\nGo before 1.8.4 and 1.9.x before 1.9.1 allows 'go get' remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some\nother work is done to ensure the proper ordering of operations, 'go\nget' can be tricked into reusing this Git checkout for the fetch of\ncode from pkg2. If the Subversion repository's Git checkout has\nmalicious commands in .git/hooks/, they will execute on the system\nrunning 'go get.' (CVE-2017-15041)\n\nsmtp.PlainAuth susceptible to man-in-the-middle password harvesting\n\nAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x\nbefore 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth\nscheme must only be used on network connections secured with TLS. The\noriginal implementation of smtp.PlainAuth in Go 1.0 enforced this\nrequirement, and it was documented to do so. In 2013, upstream issue\n#5184, this was changed so that the server may decide whether PLAIN is\nacceptable. The result is that if you set up a man-in-the-middle SMTP\nserver that doesn't advertise STARTTLS and does advertise that PLAIN\nauth is OK, the smtp.PlainAuth implementation sends the username and\npassword. (CVE-2017-15042)", "edition": 24, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-11-06T00:00:00", "title": "Amazon Linux AMI : golang (ALAS-2017-918)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:golang-docs", "p-cpe:/a:amazon:linux:golang-misc", "p-cpe:/a:amazon:linux:golang-src", "p-cpe:/a:amazon:linux:golang-bin", "p-cpe:/a:amazon:linux:golang", "p-cpe:/a:amazon:linux:golang-race", "cpe:/o:amazon:linux", "p-cpe:/a:amazon:linux:golang-tests"], "id": "ALA_ALAS-2017-918.NASL", "href": "https://www.tenable.com/plugins/nessus/104392", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2017-918.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(104392);\n script_version(\"3.3\");\n script_cvs_date(\"Date: 2018/04/18 15:09:36\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_xref(name:\"ALAS\", value:\"2017-918\");\n\n script_name(english:\"Amazon Linux AMI : golang (ALAS-2017-918)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Arbitrary code execution during go get or go get -d :\n\nGo before 1.8.4 and 1.9.x before 1.9.1 allows 'go get' remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some\nother work is done to ensure the proper ordering of operations, 'go\nget' can be tricked into reusing this Git checkout for the fetch of\ncode from pkg2. If the Subversion repository's Git checkout has\nmalicious commands in .git/hooks/, they will execute on the system\nrunning 'go get.' (CVE-2017-15041)\n\nsmtp.PlainAuth susceptible to man-in-the-middle password harvesting\n\nAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x\nbefore 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth\nscheme must only be used on network connections secured with TLS. The\noriginal implementation of smtp.PlainAuth in Go 1.0 enforced this\nrequirement, and it was documented to do so. In 2013, upstream issue\n#5184, this was changed so that the server may decide whether PLAIN is\nacceptable. The result is that if you set up a man-in-the-middle SMTP\nserver that doesn't advertise STARTTLS and does advertise that PLAIN\nauth is OK, the smtp.PlainAuth implementation sends the username and\npassword. (CVE-2017-15042)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2017-918.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update golang' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-race\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-src\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/11/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"golang-1.8.4-1.41.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"golang-bin-1.8.4-1.41.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"golang-docs-1.8.4-1.41.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"golang-misc-1.8.4-1.41.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", cpu:\"x86_64\", reference:\"golang-race-1.8.4-1.41.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"golang-src-1.8.4-1.41.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"golang-tests-1.8.4-1.41.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang / golang-bin / golang-docs / golang-misc / golang-race / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-14T18:25:10", "description": "The following packages have been upgraded to a later upstream version:\ngolang (1.9.4).\n\nSecurity Fix(es) :\n\n - golang: arbitrary code execution during 'go get' or 'go\n get -d' (CVE-2017-15041)\n\n - golang: smtp.PlainAuth susceptible to man-in-the-middle\n password harvesting (CVE-2017-15042)\n\n - golang: arbitrary code execution during 'go get' via C\n compiler options (CVE-2018-6574)\n\nAdditional Changes :", "edition": 13, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-05-01T00:00:00", "title": "Scientific Linux Security Update : golang on SL7.x (noarch) (20180410)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042", "CVE-2018-6574"], "modified": "2018-05-01T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:golang-tests", "p-cpe:/a:fermilab:scientific_linux:golang-misc", "p-cpe:/a:fermilab:scientific_linux:golang-docs", "p-cpe:/a:fermilab:scientific_linux:golang-src", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20180410_GOLANG_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/nessus/109448", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109448);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/02/24\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\", \"CVE-2018-6574\");\n\n script_name(english:\"Scientific Linux Security Update : golang on SL7.x (noarch) (20180410)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The following packages have been upgraded to a later upstream version:\ngolang (1.9.4).\n\nSecurity Fix(es) :\n\n - golang: arbitrary code execution during 'go get' or 'go\n get -d' (CVE-2017-15041)\n\n - golang: smtp.PlainAuth susceptible to man-in-the-middle\n password harvesting (CVE-2017-15042)\n\n - golang: arbitrary code execution during 'go get' via C\n compiler options (CVE-2018-6574)\n\nAdditional Changes :\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1804&L=scientific-linux-errata&F=&S=&P=4737\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?50d1e712\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:golang-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:golang-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:golang-src\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:golang-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 7.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", reference:\"golang-docs-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"golang-misc-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"golang-src-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"golang-tests-1.9.4-1.el7\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang-docs / golang-misc / golang-src / golang-tests\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T05:10:56", "description": "An update for golang is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe golang packages provide the Go programming language compiler.\n\nThe following packages have been upgraded to a later upstream version:\ngolang (1.9.4). (BZ#1479095, BZ#1499827)\n\nSecurity Fix(es) :\n\n* golang: arbitrary code execution during 'go get' or 'go get -d'\n(CVE-2017-15041)\n\n* golang: smtp.PlainAuth susceptible to man-in-the-middle password\nharvesting (CVE-2017-15042)\n\n* golang: arbitrary code execution during 'go get' via C compiler\noptions (CVE-2018-6574)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nAdditional Changes :\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 7.5 Release Notes linked from the References section.", "edition": 24, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-04-11T00:00:00", "title": "RHEL 7 : golang (RHSA-2018:0878)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042", "CVE-2018-6574"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:golang-bin", "p-cpe:/a:redhat:enterprise_linux:golang", "cpe:/o:redhat:enterprise_linux:7.7", "p-cpe:/a:redhat:enterprise_linux:golang-docs", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:golang-tests", "p-cpe:/a:redhat:enterprise_linux:golang-src", "p-cpe:/a:redhat:enterprise_linux:golang-misc", "cpe:/o:redhat:enterprise_linux:7.6"], "id": "REDHAT-RHSA-2018-0878.NASL", "href": "https://www.tenable.com/plugins/nessus/108990", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2018:0878. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(108990);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/10/24 15:35:44\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\", \"CVE-2018-6574\");\n script_xref(name:\"RHSA\", value:\"2018:0878\");\n\n script_name(english:\"RHEL 7 : golang (RHSA-2018:0878)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for golang is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe golang packages provide the Go programming language compiler.\n\nThe following packages have been upgraded to a later upstream version:\ngolang (1.9.4). (BZ#1479095, BZ#1499827)\n\nSecurity Fix(es) :\n\n* golang: arbitrary code execution during 'go get' or 'go get -d'\n(CVE-2017-15041)\n\n* golang: smtp.PlainAuth susceptible to man-in-the-middle password\nharvesting (CVE-2017-15042)\n\n* golang: arbitrary code execution during 'go get' via C compiler\noptions (CVE-2018-6574)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nAdditional Changes :\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 7.5 Release Notes linked from the References section.\"\n );\n # https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?dde41582\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2018:0878\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15041\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15042\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2018-6574\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:golang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:golang-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:golang-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:golang-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:golang-src\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:golang-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/04/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2018:0878\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"golang-1.9.4-1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"golang-1.9.4-1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"golang-bin-1.9.4-1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"golang-bin-1.9.4-1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"golang-docs-1.9.4-1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"golang-misc-1.9.4-1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"golang-src-1.9.4-1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"golang-tests-1.9.4-1.el7\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang / golang-bin / golang-docs / golang-misc / golang-src / etc\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T01:16:29", "description": "Arbitrary code execution during go get or go get -d\n\nGo before 1.8.4 and 1.9.x before 1.9.1 allows 'go get' remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some\nother work is done to ensure the proper ordering of operations, 'go\nget' can be tricked into reusing this Git checkout for the fetch of\ncode from pkg2. If the Subversion repository's Git checkout has\nmalicious commands in .git/hooks/, they will execute on the system\nrunning 'go get.'(CVE-2017-15041)\n\nsmtp.PlainAuth susceptible to man-in-the-middle password harvesting\n\nAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x\nbefore 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth\nscheme must only be used on network connections secured with TLS. The\noriginal implementation of smtp.PlainAuth in Go 1.0 enforced this\nrequirement, and it was documented to do so. In 2013, upstream issue\n#5184, this was changed so that the server may decide whether PLAIN is\nacceptable. The result is that if you set up a man-in-the-middle SMTP\nserver that doesn't advertise STARTTLS and does advertise that PLAIN\nauth is OK, the smtp.PlainAuth implementation sends the username and\npassword.(CVE-2017-15042)\n\nArbitrary code execution during 'go get' via C compiler options\n\nAn arbitrary command execution flaw was found in the way Go's 'go get'\ncommand handled gcc and clang sensitive options during the build. A\nremote attacker capable of hosting malicious repositories could\npotentially use this flaw to cause arbitrary command execution on the\nclient side.(CVE-2018-6574)", "edition": 22, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-05-11T00:00:00", "title": "Amazon Linux 2 : golang (ALAS-2018-1011)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042", "CVE-2018-6574"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:golang-docs", "p-cpe:/a:amazon:linux:golang-misc", "cpe:/o:amazon:linux:2", "p-cpe:/a:amazon:linux:golang-src", "p-cpe:/a:amazon:linux:golang-bin", "p-cpe:/a:amazon:linux:golang", "p-cpe:/a:amazon:linux:golang-tests"], "id": "AL2_ALAS-2018-1011.NASL", "href": "https://www.tenable.com/plugins/nessus/109690", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux 2 Security Advisory ALAS-2018-1011.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109690);\n script_version(\"1.1\");\n script_cvs_date(\"Date: 2018/05/11 12:23:24\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\", \"CVE-2018-6574\");\n script_xref(name:\"ALAS\", value:\"2018-1011\");\n\n script_name(english:\"Amazon Linux 2 : golang (ALAS-2018-1011)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux 2 host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Arbitrary code execution during go get or go get -d\n\nGo before 1.8.4 and 1.9.x before 1.9.1 allows 'go get' remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some\nother work is done to ensure the proper ordering of operations, 'go\nget' can be tricked into reusing this Git checkout for the fetch of\ncode from pkg2. If the Subversion repository's Git checkout has\nmalicious commands in .git/hooks/, they will execute on the system\nrunning 'go get.'(CVE-2017-15041)\n\nsmtp.PlainAuth susceptible to man-in-the-middle password harvesting\n\nAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x\nbefore 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth\nscheme must only be used on network connections secured with TLS. The\noriginal implementation of smtp.PlainAuth in Go 1.0 enforced this\nrequirement, and it was documented to do so. In 2013, upstream issue\n#5184, this was changed so that the server may decide whether PLAIN is\nacceptable. The result is that if you set up a man-in-the-middle SMTP\nserver that doesn't advertise STARTTLS and does advertise that PLAIN\nauth is OK, the smtp.PlainAuth implementation sends the username and\npassword.(CVE-2017-15042)\n\nArbitrary code execution during 'go get' via C compiler options\n\nAn arbitrary command execution flaw was found in the way Go's 'go get'\ncommand handled gcc and clang sensitive options during the build. A\nremote attacker capable of hosting malicious repositories could\npotentially use this flaw to cause arbitrary command execution on the\nclient side.(CVE-2018-6574)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/AL2/ALAS-2018-1011.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update golang' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-src\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:golang-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux:2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"2\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux 2\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"AL2\", cpu:\"x86_64\", reference:\"golang-1.9.4-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", cpu:\"x86_64\", reference:\"golang-bin-1.9.4-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"golang-docs-1.9.4-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"golang-misc-1.9.4-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"golang-src-1.9.4-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"golang-tests-1.9.4-1.amzn2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang / golang-bin / golang-docs / golang-misc / golang-src / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T01:28:41", "description": "An update for golang is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe golang packages provide the Go programming language compiler.\n\nThe following packages have been upgraded to a later upstream version:\ngolang (1.9.4). (BZ#1479095, BZ#1499827)\n\nSecurity Fix(es) :\n\n* golang: arbitrary code execution during 'go get' or 'go get -d'\n(CVE-2017-15041)\n\n* golang: smtp.PlainAuth susceptible to man-in-the-middle password\nharvesting (CVE-2017-15042)\n\n* golang: arbitrary code execution during 'go get' via C compiler\noptions (CVE-2018-6574)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nAdditional Changes :\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 7.5 Release Notes linked from the References section.", "edition": 24, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-04-27T00:00:00", "title": "CentOS 7 : golang (CESA-2018:0878)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042", "CVE-2018-6574"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:centos:centos:golang", "p-cpe:/a:centos:centos:golang-tests", "cpe:/o:centos:centos:7", "p-cpe:/a:centos:centos:golang-src", "p-cpe:/a:centos:centos:golang-docs", "p-cpe:/a:centos:centos:golang-misc", "p-cpe:/a:centos:centos:golang-bin"], "id": "CENTOS_RHSA-2018-0878.NASL", "href": "https://www.tenable.com/plugins/nessus/109376", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2018:0878 and \n# CentOS Errata and Security Advisory 2018:0878 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109376);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/12/31\");\n\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\", \"CVE-2018-6574\");\n script_xref(name:\"RHSA\", value:\"2018:0878\");\n\n script_name(english:\"CentOS 7 : golang (CESA-2018:0878)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for golang is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe golang packages provide the Go programming language compiler.\n\nThe following packages have been upgraded to a later upstream version:\ngolang (1.9.4). (BZ#1479095, BZ#1499827)\n\nSecurity Fix(es) :\n\n* golang: arbitrary code execution during 'go get' or 'go get -d'\n(CVE-2017-15041)\n\n* golang: smtp.PlainAuth susceptible to man-in-the-middle password\nharvesting (CVE-2017-15042)\n\n* golang: arbitrary code execution during 'go get' via C compiler\noptions (CVE-2018-6574)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nAdditional Changes :\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 7.5 Release Notes linked from the References section.\"\n );\n # https://lists.centos.org/pipermail/centos-cr-announce/2018-April/004827.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?10b25a92\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected golang packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15041\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:golang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:golang-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:golang-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:golang-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:golang-src\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:golang-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/04/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 7.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"golang-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"golang-bin-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"golang-docs-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"golang-misc-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"golang-src-1.9.4-1.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"golang-tests-1.9.4-1.el7\")) flag++;\n\n\nif (flag)\n{\n cr_plugin_caveat = '\\n' +\n 'NOTE: The security advisory associated with this vulnerability has a\\n' +\n 'fixed package version that may only be available in the continuous\\n' +\n 'release (CR) repository for CentOS, until it is present in the next\\n' +\n 'point release of CentOS.\\n\\n' +\n\n 'If an equal or higher package level does not exist in the baseline\\n' +\n 'repository for your major version of CentOS, then updates from the CR\\n' +\n 'repository will need to be applied in order to address the\\n' +\n 'vulnerability.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + cr_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"golang / golang-bin / golang-docs / golang-misc / golang-src / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2019-05-29T18:34:18", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-10-21T00:00:00", "id": "OPENVAS:1361412562310873512", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873512", "type": "openvas", "title": "Fedora Update for golang FEDORA-2017-8f7bca960b", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_8f7bca960b_golang_fc25.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for golang FEDORA-2017-8f7bca960b\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873512\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-10-21 09:52:18 +0200 (Sat, 21 Oct 2017)\");\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for golang FEDORA-2017-8f7bca960b\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'golang'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"golang on Fedora 25\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-8f7bca960b\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R4F3GYEPSBEPPNXZCXHFLN2S2B66GDBA\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC25\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC25\")\n{\n\n if ((res = isrpmvuln(pkg:\"golang\", rpm:\"golang~1.7.6~3.fc25\", rls:\"FC25\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:34:10", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-10-21T00:00:00", "id": "OPENVAS:1361412562310873516", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873516", "type": "openvas", "title": "Fedora Update for golang FEDORA-2017-6f1b90dbb7", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_6f1b90dbb7_golang_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for golang FEDORA-2017-6f1b90dbb7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873516\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-10-21 09:52:48 +0200 (Sat, 21 Oct 2017)\");\n script_cve_id(\"CVE-2017-15041\", \"CVE-2017-15042\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for golang FEDORA-2017-6f1b90dbb7\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'golang'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"golang on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-6f1b90dbb7\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SFCC7E7XZUSJKXFRXRASC4BKMRRGE2R\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"golang\", rpm:\"golang~1.8.4~1.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-29T20:06:59", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041"], "description": "Go before 1.8.4 and 1.9.x before 1.9.1 allows ", "modified": "2020-01-29T00:00:00", "published": "2018-02-07T00:00:00", "id": "OPENVAS:1361412562310891148", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891148", "type": "openvas", "title": "Debian LTS: Security Advisory for golang (DLA-1148-1)", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891148\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2017-15041\");\n script_name(\"Debian LTS: Security Advisory for golang (DLA-1148-1)\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-02-07 00:00:00 +0100 (Wed, 07 Feb 2018)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2017/10/msg00027.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n\n script_tag(name:\"affected\", value:\"golang on Debian Linux\");\n\n script_tag(name:\"solution\", value:\"For Debian 7 'Wheezy', these problems have been fixed in version\n2:1.0.2-1.1+deb7u2.\n\nWe recommend that you upgrade your golang packages.\");\n\n script_tag(name:\"summary\", value:\"Go before 1.8.4 and 1.9.x before 1.9.1 allows 'go get' remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some\nother work is done to ensure the proper ordering of operations, 'go\nget' can be tricked into reusing this Git checkout for the fetch of\ncode from pkg2. If the Subversion repository's Git checkout has\nmalicious commands in .git/hooks/, they will execute on the system\nrunning 'go get.'\");\n\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"golang\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"golang-dbg\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"golang-doc\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"golang-go\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"golang-mode\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"golang-src\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"kate-syntax-go\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-syntax-go\", ver:\"2:1.0.2-1.1+deb7u2\", rls:\"DEB7\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-27T18:37:20", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220171311", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220171311", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2017-1311)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2017.1311\");\n script_version(\"2020-01-23T11:06:43+0000\");\n script_cve_id(\"CVE-2017-15041\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:06:43 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:06:43 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2017-1311)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2017-1311\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1311\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'golang' package(s) announced via the EulerOS-SA-2017-1311 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Go before 1.8.4 and 1.9.x before 1.9.1 allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.'(CVE-2017-15041)\");\n\n script_tag(name:\"affected\", value:\"'golang' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"golang\", rpm:\"golang~1.8.3~1.2.1.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"golang-bin\", rpm:\"golang-bin~1.8.3~1.2.1.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"golang-src\", rpm:\"golang-src~1.8.3~1.2.1.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "amazon": [{"lastseen": "2020-11-10T12:35:08", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "description": "**Issue Overview:**\n\nArbitrary code execution during go get or go get -d: \nGo before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get." ([CVE-2017-15041 __](<https://access.redhat.com/security/cve/CVE-2017-15041>))\n\nsmtp.PlainAuth susceptible to man-in-the-middle password harvesting \nAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password. ([CVE-2017-15042 __](<https://access.redhat.com/security/cve/CVE-2017-15042>))\n\n \n**Affected Packages:** \n\n\ngolang\n\n \n**Issue Correction:** \nRun _yum update golang_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n golang-bin-1.8.4-1.41.amzn1.i686 \n golang-1.8.4-1.41.amzn1.i686 \n \n noarch: \n golang-tests-1.8.4-1.41.amzn1.noarch \n golang-src-1.8.4-1.41.amzn1.noarch \n golang-docs-1.8.4-1.41.amzn1.noarch \n golang-misc-1.8.4-1.41.amzn1.noarch \n \n src: \n golang-1.8.4-1.41.amzn1.src \n \n x86_64: \n golang-bin-1.8.4-1.41.amzn1.x86_64 \n golang-race-1.8.4-1.41.amzn1.x86_64 \n golang-1.8.4-1.41.amzn1.x86_64 \n \n \n", "edition": 5, "modified": "2017-11-02T20:17:00", "published": "2017-11-02T20:17:00", "id": "ALAS-2017-918", "href": "https://alas.aws.amazon.com/ALAS-2017-918.html", "title": "Medium: golang", "type": "amazon", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-11-10T12:37:14", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042", "CVE-2018-6574"], "description": "**Issue Overview:**\n\nArbitrary code execution during go get or go get -d \nGo before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."([CVE-2017-15041 __](<https://access.redhat.com/security/cve/CVE-2017-15041>))\n\nsmtp.PlainAuth susceptible to man-in-the-middle password harvesting \nAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.([CVE-2017-15042 __](<https://access.redhat.com/security/cve/CVE-2017-15042>))\n\nArbitrary code execution during \"go get\" via C compiler options \nAn arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side.([CVE-2018-6574 __](<https://access.redhat.com/security/cve/CVE-2018-6574>))\n\n \n**Affected Packages:** \n\n\ngolang\n\n \n**Issue Correction:** \nRun _yum update golang_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n noarch: \n golang-docs-1.9.4-1.amzn2.noarch \n golang-misc-1.9.4-1.amzn2.noarch \n golang-tests-1.9.4-1.amzn2.noarch \n golang-src-1.9.4-1.amzn2.noarch \n \n src: \n golang-1.9.4-1.amzn2.src \n \n x86_64: \n golang-1.9.4-1.amzn2.x86_64 \n golang-bin-1.9.4-1.amzn2.x86_64 \n \n \n", "edition": 1, "modified": "2018-05-10T17:19:00", "published": "2018-05-10T17:19:00", "id": "ALAS2-2018-1011", "href": "https://alas.aws.amazon.com/AL2/ALAS-2018-1011.html", "title": "Medium: golang", "type": "amazon", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2017-10-23T04:34:50", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "description": "### Background\n\nGo is an open source programming language that makes it easy to build simple, reliable, and efficient software. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Go. Please review the references below for details. \n\n### Impact\n\nRemote attackers could execute arbitrary Go commands or conduct a man in the middle attack. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Go users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-lang/go-1.9.1\"", "edition": 1, "modified": "2017-10-23T00:00:00", "published": "2017-10-23T00:00:00", "href": "https://security.gentoo.org/glsa/201710-23", "id": "GLSA-201710-23", "title": "Go: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 0.0, "vector": "NONE"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "description": "The Go Programming Language. ", "modified": "2017-10-19T19:21:02", "published": "2017-10-19T19:21:02", "id": "FEDORA:D75F76124F67", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 25 Update: golang-1.7.6-3.fc25", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "description": "The Go Programming Language. ", "modified": "2017-10-11T14:48:46", "published": "2017-10-11T14:48:46", "id": "FEDORA:6F14B6261E2D", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: golang-1.9.1-1.fc27", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042"], "description": "The Go Programming Language. ", "modified": "2017-10-17T19:21:49", "published": "2017-10-17T19:21:49", "id": "FEDORA:7792D6076D27", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: golang-1.8.4-1.fc26", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2019-08-13T18:46:59", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042", "CVE-2018-6574"], "description": "The golang packages provide the Go programming language compiler.\n\nThe following packages have been upgraded to a later upstream version: golang (1.9.4). (BZ#1479095, BZ#1499827)\n\nSecurity Fix(es):\n\n* golang: arbitrary code execution during \"go get\" or \"go get -d\" (CVE-2017-15041)\n\n* golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting (CVE-2017-15042)\n\n* golang: arbitrary code execution during \"go get\" via C compiler options (CVE-2018-6574)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.", "modified": "2018-04-10T10:36:27", "published": "2018-04-10T09:02:59", "id": "RHSA-2018:0878", "href": "https://access.redhat.com/errata/RHSA-2018:0878", "type": "redhat", "title": "(RHSA-2018:0878) Moderate: golang security, bug fix, and enhancement update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "centos": [{"lastseen": "2019-12-20T18:27:15", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041", "CVE-2017-15042", "CVE-2018-6574"], "description": "**CentOS Errata and Security Advisory** CESA-2018:0878\n\n\nThe golang packages provide the Go programming language compiler.\n\nThe following packages have been upgraded to a later upstream version: golang (1.9.4). (BZ#1479095, BZ#1499827)\n\nSecurity Fix(es):\n\n* golang: arbitrary code execution during \"go get\" or \"go get -d\" (CVE-2017-15041)\n\n* golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting (CVE-2017-15042)\n\n* golang: arbitrary code execution during \"go get\" via C compiler options (CVE-2018-6574)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2018-April/004827.html\n\n**Affected packages:**\ngolang\ngolang-bin\ngolang-docs\ngolang-misc\ngolang-src\ngolang-tests\n\n**Upstream details at:**\n", "edition": 3, "modified": "2018-04-26T17:42:06", "published": "2018-04-26T17:42:06", "id": "CESA-2018:0878", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2018-April/004827.html", "title": "golang security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041"], "description": "Arch Linux Security Advisory ASA-201710-15\n==========================================\n\nSeverity: High\nDate : 2017-10-12\nCVE-ID : CVE-2017-15041\nPackage : go\nType : arbitrary command execution\nRemote : Yes\nLink : https://security.archlinux.org/AVG-442\n\nSummary\n=======\n\nThe package go before version 2:1.9.1-1 is vulnerable to arbitrary\ncommand execution.\n\nResolution\n==========\n\nUpgrade to 2:1.9.1-1.\n\n# pacman -Syu \"go>=2:1.9.1-1\"\n\nThe problem has been fixed upstream in version 1.9.1.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\nGo before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some other\nwork is done to ensure the proper ordering of operations, \"go get\" can\nbe tricked into reusing this Git checkout for the fetch of code from\npkg2. If the Subversion repository's Git checkout has malicious\ncommands in .git/hooks/, they will execute on the system running \"go\nget\".\n\nImpact\n======\n\nA remote attacker may be able to execute arbitrary commands on a system\nrunning \"go get\" by using a specially prepared repository.\n\nReferences\n==========\n\nhttps://github.com/golang/go/issues/22125\nhttps://github.com/golang/tools/commit/ebae2dcdbabadfdb9880a627481eaf0079a08767\nhttps://security.archlinux.org/CVE-2017-15041", "modified": "2017-10-12T00:00:00", "published": "2017-10-12T00:00:00", "id": "ASA-201710-15", "href": "https://security.archlinux.org/ASA-201710-15", "type": "archlinux", "title": "[ASA-201710-15] go: arbitrary command execution", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041"], "description": "Arch Linux Security Advisory ASA-201710-16\n==========================================\n\nSeverity: High\nDate : 2017-10-12\nCVE-ID : CVE-2017-15041\nPackage : go-pie\nType : arbitrary command execution\nRemote : Yes\nLink : https://security.archlinux.org/AVG-442\n\nSummary\n=======\n\nThe package go-pie before version 2:1.9.1-1 is vulnerable to arbitrary\ncommand execution.\n\nResolution\n==========\n\nUpgrade to 2:1.9.1-1.\n\n# pacman -Syu \"go-pie>=2:1.9.1-1\"\n\nThe problem has been fixed upstream in version 1.9.1.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\nGo before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some other\nwork is done to ensure the proper ordering of operations, \"go get\" can\nbe tricked into reusing this Git checkout for the fetch of code from\npkg2. If the Subversion repository's Git checkout has malicious\ncommands in .git/hooks/, they will execute on the system running \"go\nget\".\n\nImpact\n======\n\nA remote attacker may be able to execute arbitrary commands on a system\nrunning \"go get\" by using a specially prepared repository.\n\nReferences\n==========\n\nhttps://github.com/golang/go/issues/22125\nhttps://github.com/golang/tools/commit/ebae2dcdbabadfdb9880a627481eaf0079a08767\nhttps://security.archlinux.org/CVE-2017-15041", "modified": "2017-10-12T00:00:00", "published": "2017-10-12T00:00:00", "id": "ASA-201710-16", "href": "https://security.archlinux.org/ASA-201710-16", "type": "archlinux", "title": "[ASA-201710-16] go-pie: arbitrary command execution", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2019-05-30T02:23:05", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15041"], "description": "Package : golang\nVersion : 2:1.0.2-1.1+deb7u2\nCVE ID : CVE-2017-15041\n\nGo before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command\nexecution. Using custom domains, it is possible to arrange things so\nthat example.com/pkg1 points to a Subversion repository but\nexample.com/pkg1/pkg2 points to a Git repository. If the Subversion\nrepository includes a Git checkout in its pkg2 directory and some\nother work is done to ensure the proper ordering of operations, "go\nget" can be tricked into reusing this Git checkout for the fetch of\ncode from pkg2. If the Subversion repository's Git checkout has\nmalicious commands in .git/hooks/, they will execute on the system\nrunning "go get."\n\nFor Debian 7 "Wheezy", these problems have been fixed in version\n2:1.0.2-1.1+deb7u2.\n\nWe recommend that you upgrade your golang packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "edition": 3, "modified": "2017-10-27T15:44:01", "published": "2017-10-27T15:44:01", "id": "DEBIAN:DLA-1148-1:4C88F", "href": "https://lists.debian.org/debian-lts-announce/2017/debian-lts-announce-201710/msg00027.html", "title": "[SECURITY] [DLA 1148-1] golang security update", "type": "debian", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
