SUSE-SU-2025:03524-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to version 1.25.1, released 2025-09-03 bsc1244485. Security issues fixed: - CVE-2025-47910: net/http: CrossOriginProtection insecure bypass patterns not limited to exact matches bsc1249141. Other issues fixed: - go74822 cmd/go: 'ge...

Fedora: Security Advisory (FEDORA-2025-a88ad31d87)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-0226657320)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-49400d941c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-e36ffc5112)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-b3288aa9bf)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : containernetworking-plugins (2025-b3288aa9bf)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b3288aa9bf advisory. Resolve CVE-2025-47910 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 42 : containernetworking-plugins (2025-e36ffc5112)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e36ffc5112 advisory. Resolve CVE-2025-47910 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 43 : containernetworking-plugins (2025-f4d64845aa)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f4d64845aa advisory. - Resolve CVE-2025-47910 - Resolves: rhbz2398656, rhbz2398402 - Rebuild with go 1.25.1 fc44, fc43 or 1.24.7 fc42, fc41 Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2025-47910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips...

CVE-2025-47910

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...

CVE-2025-47910 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, cloud-provider-gcp-cloud-controller-manager, ip-masq-agent, kube-bench, steampipe, grafana-alloy, migrate, ko, kubernetes-dashboard-auth, flux, rclone, terraform-mcp-server, cluster-api-azure-controller, azure-service-operator, k3d,...

CVE-2025-47910

CVE-2025-47910 — Normal (detailed) The connected sources confirm a vulnerability in Go’s net/http CrossOriginProtection: the AddInsecureBypassPattern can bypass more requests than intended, causing CrossOriginProtection to skip validation while forwarding the original request path. This may allow...

openSUSE Security Advisory (SUSE-SU-2025:03200-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2025:03200-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2025:03200-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03200-1 advisory. Update to go1.25.1, released 2025-09-03 bsc1244485. Security issues fixed: - CVE-2025-47910: net/http:...

go1.25-1.25.1-1.1 on GA media (moderate)

go1.25-1.25.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15525-1 Rating: moderate Cross-References: CVE-2025-47910 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the go1.25-1.25.1-1.1...

Golang 1.24.x < 1.24.7 / 1.25.x < 1.25.1 Insecure Bypass (75054)

The version of Golang running on the remote host is 1.24.x prior to 1.24.7, 1.25.x prior to 1.25.1. It is, therefore, affected by a vulnerability as referenced in 75054 advisory. - When passing patterns to CrossOriginProtection.AddInsecureBypassPattern, requests that would have redirected to thos...

CVE-2025-47910

creationtimestamp| type| source ---|---|--- 2025-09-03 18:09:35+00:00| seen| https://bsky.app/profile/golang.org/post/3lxxa2w5izg25 2025-09-04 02:09:19+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3lxy2urp36l2b 2025-09-06 02:08:55+00:00| seen|...

PT-2025-35858

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.25.1 Go versions prior to 1.24.7 Description The AddInsecureBypassPattern method within the http.CrossOriginProtection functionality can incorrectly bypass more requests than intended. This bypass occurs because...