47 matches found
Security update for go1.24-openssl
This update for go1.24-openssl fixes the following issues: Update to version 1.24.4 bsc1236217: CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation bsc1244158. CVE-2025-0913 os: inconsistent handling of OCREATE|OEXCL on Unix and Windows bsc1244157. CVE-2025-4673 net/http:...
Medium: amazon-cloudwatch-agent
Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...
Medium: golang
Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...
Medium: golang
Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...
Medium: amazon-cloudwatch-agent
Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...
CVE-2025-22874 vulnerabilities
Vulnerabilities for packages: sbom-scorecard, bazelisk, falco-exporter, nri-mysql, step, k8ssandra-operator, nri-elasticsearch, mage, grafana-operator, docker-credential-ecr-login, authservice, render-template, pdfcpu, dbmate, kine, nvidia-container-toolkit, metrics-server,...
CVE-2025-22874 vulnerabilities
Vulnerabilities for packages: beats-fips, eck-operator-fips, step-issuer, wavefront-collector-for-kubernetes, mc, aws-load-balancer-controller, dapr-fips, nvidia-container-toolkit, rancher-webhook, kubewatch, nfs-subdir-external-provisioner, http-echo, newrelic-prometheus-configurator,...
CVE-2025-22874
A flaw was found in Go's crypto/x509 package. This vulnerability allows improper certificate validation, bypassing policy constraints via using ExtKeyUsageAny in VerifyOptions.KeyUsages...
Mageia: Security Advisory (MGASA-2025-0184)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-22874
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...
CVE-2025-22874
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...
CVE-2025-22874 Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...
CVE-2025-22874 Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...
CVE-2025-22874
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...
CVE-2025-22874
CVE-2025-22874 is confirmed in multiple advisories (ALAS/AL2/ECS) tied to Go crypto/X509 verification where Verify with VerifyOptions.KeyUsages containing ExtKeyUsageAny disables policy validation for some certificate chains with policy graphs. Concrete affected packages include amazon-ssm-agent ...
openSUSE Security Advisory (SUSE-SU-2025:01846-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:01846-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01846-1 advisory. go1.24.4 released 2025-06-05 includes security fixes to the crypto/x509, net/http, and os...
SUSE-SU-2025:01846-1 Security update for go1.24
This update for go1.24 fixes the following issues: go1.24.4 released 2025-06-05 includes security fixes to the crypto/x509, net/http, and os packages, as well as bug fixes to the linker, the go command, and the hash/maphash and os packages. bsc1236217 go1.24 release tracking CVE-2025-22874...
CVE-2025-22874
creationtimestamp| type| source ---|---|--- 2025-06-05 17:14:55+00:00| seen| https://seclists.org/oss-sec/2025/q2/217 2025-06-05 18:53:38+00:00| seen| https://bsky.app/profile/golang.org/post/3lquykqnbkk2d 2025-06-05 20:02:12+00:00| seen|...