CLSA-2025-1752086959 Update of ca-certificates

update to CKBI 2.74 from NSS 3.110 - updated certificates: - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Entrust Root Certification Authority" - Certificate "AffirmTrust Commercial" - Certificate "AffirmTrust Networking" - Certificate "AffirmTrust Premium" - Certificate...

RHSA-2025:10672 Red Hat Security Advisory: go-toolset:rhel8 security update

Bulletin has no description...

Moderate: Red Hat Security Advisory: go-toolset:rhel8 security update

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509

A flaw was found in Go's crypto/x509 package. This vulnerability allows improper certificate validation, bypassing policy constraints via using ExtKeyUsageAny in VerifyOptions.KeyUsages...

OPENSUSE-SU-2025:15329-1 go1.24-1.24.5-1.1 on GA media

These are all security issues fixed in the go1.24-1.24.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15328-1 go1.23-1.23.11-1.1 on GA media

These are all security issues fixed in the go1.23-1.23.11-1.1 package on the GA media of openSUSE Tumbleweed...

Moderate: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 For more details about the security issues, including the impact, a CVSS score,...

RHEL 8 : go-toolset:rhel8 (RHSA-2025:10672)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10672 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/http: Sensitive header...

OPENSUSE-SU-2025:15330-1 go1.25-1.25rc2-1.1 on GA media

These are all security issues fixed in the go1.25-1.25rc2-1.1 package on the GA media of openSUSE Tumbleweed...

ALSA-2025:10672 Moderate: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 For more details about the security issues, including the impact, a CVSS score,...

SUSE CVE-2025-4674

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS e.g. Git, but contains metadata for another VCS e.g. Mercurial...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

ROS-20250703-02

A vulnerability in the Go programming language is related to improper syntax correctness checking of input. Exploitation of the vulnerability allows an attacker acting remotely to cause a denial of service...

OPENSUSE-SU-2025:15223-1 go1.23-1.23.10-1.1 on GA media

These are all security issues fixed in the go1.23-1.23.10-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15224-1 go1.24-1.24.4-1.1 on GA media

These are all security issues fixed in the go1.24-1.24.4-1.1 package on the GA media of openSUSE Tumbleweed...

AlmaLinux 8 : container-tools:4.0 (ALSA-2023:6938)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:6938 advisory. go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handlin...

The vulnerabilities of the Go programming language’s packages net/http, x/net/proxy, and x/net/http/httpproxy allow attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the net/http, x/net/proxy, and x/net/http/httpproxy libraries in the Go programming language is related to incorrect matching of hosts with proxy server templates. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and accessibility of...

GHSA-H34R-JXQM-QGPR juju/utils leaks private key in certs

Summary Certs generated by v4 contain their private key. Details Background Recently, I encountered an API in Go that’s easy to misuse: sha512.Sum384 and sha512.New384.Sum look very similar and behave very differently. https://go.dev/play/p/kDCqqoYk84k demonstrates this. I want to discuss extendi...

ROS-20250630-09

Vulnerability of net/http, x/net/proxy and x/net/http/httpproxy packages of Go programming language is related to incorrect mapping of hosts to proxy server templates. Exploitation of the vulnerability could allow an intruder to affect confidentiality and availability of protected information A...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata from version 20250416.01 Refactor OS Info package from version...