ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2021.0018
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2021-0018)
Resumen:	The remote host is missing an update for the 'golang' package(s) announced via the MGASA-2021-0018 advisory.
Descripción:	Summary: The remote host is missing an update for the 'golang' package(s) announced via the MGASA-2021-0018 advisory. Vulnerability Insight: An input validation vulnerability was found in go. From a generated go file (from the cgo tool) it is possible to modify symbols within that object file and specify code instead. An attacker could potentially use this flaw by creating a repository which included malicious pre-built object files that could execute arbitrary code when downloaded and run via 'go get' or 'go build' whilst building a go project (CVE-2020-28366). An input validation vulnerability was found in go. If cgo is specified in a go file, it is possible to bypass the validation of arguments to the gcc compiler. An attacker could potentially use this flaw by creating a malicious repository which would execute arbitrary code when downloaded and run via 'go get' or 'go build' whilst building a go project (CVE-2020-28367). Affected Software/OS: 'golang' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 5.1 CVSS Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2020-28366 https://go.dev/cl/269658 https://go.dev/issue/42559 https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292 https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM https://pkg.go.dev/vuln/GO-2022-0475 Common Vulnerability Exposure (CVE) ID: CVE-2020-28367 https://go.dev/cl/267277 https://go.dev/issue/42556 https://go.googlesource.com/go/+/da7aa86917811a571e6634b45a457f918b8e6561 https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html https://pkg.go.dev/vuln/GO-2022-0476
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.