Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:01551-1

Опубликовано: 29 мая 2025
Источник: suse-cvrf

Описание

Security update for go1.24

This update for go1.24 fixes the following issues:

Update to go1.24.3 (bsc#1236217):

Security fixes:

  • CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)

Changelog:

  • go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory
  • go#73082 os: Root.Open panics when opening a symlink referencing the root
  • go#73092 cmd/link: linkname directive on userspace variable can override runtime variable
  • go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in supportedVersions
  • go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/ runtime.OSLockThread
  • go#73192 runtime: -race data race map traceback report incorrect functions
  • go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large
  • go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64
  • go#73440 cmd/compile: infinite loop in the inliner
  • go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Список пакетов

Container bci/golang:latest
go1.24-1.24.3-150000.1.23.1
go1.24-doc-1.24.3-150000.1.23.1
go1.24-race-1.24.3-150000.1.23.1
SUSE Linux Enterprise Module for Development Tools 15 SP7
go1.24-1.24.3-150000.1.23.1
go1.24-doc-1.24.3-150000.1.23.1
go1.24-race-1.24.3-150000.1.23.1

Ссылки

Описание

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

Затронутые продукты
Container bci/golang:latest:go1.24-1.24.3-150000.1.23.1
Container bci/golang:latest:go1.24-doc-1.24.3-150000.1.23.1
Container bci/golang:latest:go1.24-race-1.24.3-150000.1.23.1
SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1
Ссылки