Security update for go1.25 (important)

openSUSE security update: security update for go1.25 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2025-20157-1 Rating: important References: bsc1244485 bsc1245878 bsc1247816 bsc1248082 bsc1249141 bsc1249985 bsc1251253 bsc1251254 bsc1251255 bsc1251256...

OPENSUSE-SU-2025:20158-1 Security update for go1.24

This update for go1.24 fixes the following issues: Update to go1.24.11. Security issues fixed: - CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames bsc1251257. - CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map bsc1251261. - CVE-2025-58185:...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:4337-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4337-1 advisory. go1.24.11 released 2025-12-02 includes two security fixes to the crypto/x509 package, as well as...

Security update for go1.24

This update for go1.24 fixes the following issues: go1.24.11 released 2025-12-02 includes two security fixes to the crypto/x509 package, as well as bug fixes to the runtime. bsc1236217 CVE-2025-61727 CVE-2025-61729: go76460 go76445 bsc1254431 security: fix CVE-2025-61729 crypto/x509: excessive...

GHSA-MJCP-GPGX-GGCG OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

When OpenTofu is acting as a TLS client authenticating a certificate chain provided by a TLS server, an excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com...

CLSA-2025-1765231763 golang: Fix of 3 CVEs

Update to Go 1.22.9 - Remove CVE-2024-34155, CVE-2024-34156, and CVE-2024-34158 patches - Remove fix-standard-crypto-panic.patch no longer needed - Add disablestatictestspart1.patch and disablestatictestspart2.patch to disable OpenSSL backend for static builds - Add...

OPENSUSE-SU-2025:15796-1 go1.24-1.24.11-1.1 on GA media

These are all security issues fixed in the go1.24-1.24.11-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 43 : migrate (2025-427af3b610)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-427af3b610 advisory. - Update to 4.19.0 - Address CVEs by rebuilding with Go 1.25.4 Tenable has extracted the preceding description block directly from the Fedora securi...

OPENSUSE-SU-2025:15795-1 go1.25-1.25.5-1.1 on GA media

These are all security issues fixed in the go1.25-1.25.5-1.1 package on the GA media of openSUSE Tumbleweed...

AZL-71255 CVE-2025-61729 affecting package golang 1.26.0-1

Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can...

Oracle Linux 9 : go-rpm-macros (ELSA-2025-22005)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-22005 advisory. - Rebuilt to include Go1.25.3 to address CVE-2025-47906 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

CVE-2025-65109 Minder does not sandbox http.send in Rego programs

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...

AZL-69254 CVE-2025-58186 affecting package golang 1.26.0-1

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption...

Golang 1.24.x < 1.24.8 / 1.25.x < 1.25.2 Multiple Vulnerabilities (qZN5nc-mBgAJ)

The version of Golang running on the remote host is 1.24.x prior to 1.24.8, 1.25.x prior to 1.25.2. It is, therefore, affected by multiple vulnerabilities as referenced in qZN5nc-mBgAJ advisory. - The Parse function permitted values other than IPv6 addresses to be included in square brackets with...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2025:3681-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:3681-1 advisory. go1.25.3 released 2025-10-13 includes fixes to the crypto/x509 package. bsc1244485 CVE-2025-58187 go75861...

Security update for go1.24

This update for go1.24 fixes the following issues: go1.24.9 released 2025-10-13 includes fixes to the crypto/x509 package. bsc1236217 crypto/x509: TLS validation fails for FQDNs with trailing dot go1.24.8 released 2025-10-07 includes security fixes to the archive/tar, crypto/tls, crypto/x509,...

SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2025:03524-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03524-1 advisory. Update to version 1.25.1, released 2025-09-03 bsc1244485. Security issues fixed: - CVE-2025-47910: net/http: CrossOriginProtection insecure...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25-openssl (SUSE-SU-2025:03525-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03525-1 advisory. Update to version 1.25.1, released 2025-09-03 bsc1244485. Security issues fixed: - CVE-2025-47910:...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to version 1.25.1, released 2025-09-03 bsc1244485. Security issues fixed: CVE-2025-47910: net/http: CrossOriginProtection insecure bypass patterns not limited to exact matches bsc1249141. Other issues fixed: go74822 cmd/go: "get...

go1.25-1.25.2-1.1 on GA media (moderate)

go1.25-1.25.2-1.1 on GA media Announcement ID: openSUSE-SU-2025:15609-1 Rating: moderate Cross-References: CVE-2025-47912 CVE-2025-58183 CVE-2025-58185 CVE-2025-58186 CVE-2025-58187 CVE-2025-58188 CVE-2025-58189 CVE-2025-61723 CVE-2025-61724 CVE-2025-61725 CVSS scores: CVE-2025-47912 SUSE : 8.7...