Описание
Security update for go1.23
This update for go1.23 fixes the following issues:
go1.23.10 (released 2025-06-05) includes security fixes to the /http and os packages, as well as bug fixes to the linker. (bsc#1229122 go1.23 release tracking CVE-2025-0913 CVE-2025-4673)
-
CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)
-
CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)
- runtime/debug: BuildSetting does not document DefaultGODEBUG
- cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen
Список пакетов
Container bci/golang:1.23
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Development Tools 15 SP6
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP3-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2025:01848-1
- E-Mail link for SUSE-SU-2025:01848-1
- SUSE Security Ratings
- SUSE Bug 1229122
- SUSE Bug 1244156
- SUSE Bug 1244157
- SUSE CVE CVE-2025-0913 page
- SUSE CVE CVE-2025-4673 page
Описание
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
Затронутые продукты
Ссылки
- CVE-2025-0913
- SUSE Bug 1244157
Описание
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
Затронутые продукты
Ссылки
- CVE-2025-4673
- SUSE Bug 1244156