Security Bulletin: IBM Storage Ceph is vulnerable to the Exposure of Sensitive Information to an Unauthorized Actor in Grafana (CVE-2025-22866)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2025-22866 Vulnerability Details CVEID:CVE-2025-22866 DESCRIPTION: Due to the usage of a variable time instruction in the assembly...

Security Bulletin: Timing Side-Channel in PPC64LE Assembly Leaks Bits of Secret Scalars in P-256 Operations, which affects IBM watsonx.data

Summary Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the...

ROOT-OS-DEBIAN-12-CVE-2025-22866 CVE-2025-22866 in rootio-golang-1.19 - Patched by Root

Root has patched CVE-2025-22866 in the rootio-golang-1.19 package for Root:Debian:12. Multiple fixed versions available...

Security Bulletin: Multiple security vulnerabilities in Go affects IBM Robotic Process Automation for Cloud Pak

Summary Multiple security vulnerabilities in Go affects IBM Robotic Process Automation for Cloud Pak. Go is used by IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details...

K000152675: Golang crypto vulnerabilities CVE-2024-24783 and CVE-2025-22866

Security Advisory Description CVE-2024-24783 Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or...

Ubuntu: Security Advisory (USN-7574-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in Golang crypto/internal/nistec [CVE-2025-22866]

Summary IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in the Golang crypto/internal/nistec package, due to the usage of a variable time instruction in the assembly implementation of an internal function, which may allow a small number of bits of secret...

RHEL 10 : delve and golang (RHSA-2025:7466)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7466 advisory. Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go...

SUSE SLES15 Security Update : go1.23-openssl (SUSE-SU-2025:01731-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01731-1 advisory. Update to version 1.23.9 bsc1229122: Security fixes: - CVE-2024-45336: net/http: sensitive headers incorrectly sent after...

SUSE: Security Advisory (SUSE-SU-2025:1555-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 24.0.0-IF005 and 24.0.1-IF002.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 24.0.0-IF005 and 24.0.1-IF002. Vulnerability Details CVEID:CVE-2025-22866 DESCRIPTION: Due to the usage of a variable time...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.5.10

Red Hat OpenShift Service Mesh Containers for 2.5.10 This update has a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift...

Security Bulletin: IBM Maximo Application Suite uses "golang.org/x/net/html, crypto/internal/nistec, net/http, crypto/x509" which is vulnerable to "CVE-2024-45338, CVE-2025-22866, CVE-2024-45336, CVE-2024-45341"

Summary IBM Maximo Application Suite uses "golang.org/x/net/html, crypto/internal/nistec, net/http, crypto/x509" which is vulnerable to "CVE-2024-45338, CVE-2025-22866, CVE-2024-45336, CVE-2024-45341". This bulletin contains information regarding the vulnerability and its fixture. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an information disclosure in Golang crypto [CVE-2025-22866]

Summary IBM Watson Speech Services Cartridge is vulnerable to an information disclosure in the Golang crypto/internal/nistec package, due to the usage of a variable time instruction in the assembly implementation of an internal function CVE-2025-22866. Golang crypto is used by our Speech utilitie...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2025-1316)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP13 : golang (EulerOS-SA-2025-1316)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars a...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2025-1333)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP13 : golang (EulerOS-SA-2025-1333)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars a...

openSUSE Security Advisory (SUSE-SU-2025:0393-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:0431-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...