Описание
Security update for go1.24-openssl
This update for go1.24-openssl fixes the following issues:
Update to version 1.24.4 (bsc#1236217):
- CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158).
- CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157).
- CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156).
Список пакетов
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP3-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2025:02120-1
- E-Mail link for SUSE-SU-2025:02120-1
- SUSE Security Ratings
- SUSE Bug 1236217
- SUSE Bug 1244156
- SUSE Bug 1244157
- SUSE Bug 1244158
- SUSE CVE CVE-2025-0913 page
- SUSE CVE CVE-2025-22874 page
- SUSE CVE CVE-2025-4673 page
Описание
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
Затронутые продукты
Ссылки
- CVE-2025-0913
- SUSE Bug 1244157
Описание
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
Затронутые продукты
Ссылки
- CVE-2025-22874
- SUSE Bug 1244158
Описание
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
Затронутые продукты
Ссылки
- CVE-2025-4673
- SUSE Bug 1244156