Описание
Security update for go1.24
This update for go1.24 fixes the following issues:
go1.24.9 (released 2025-10-13) includes fixes to the crypto/x509 package. (bsc#1236217)
- crypto/x509: TLS validation fails for FQDNs with trailing dot
go1.24.8 (released 2025-10-07) includes security fixes to the archive/tar, crypto/tls, crypto/x509, encoding/asn1, encoding/pem, net/http, net/mail, net/textproto, and net/url packages, as well as bug fixes to the compiler, the linker, and the debug/pe, net/http, os, and sync/atomic packages. (bsc#1236217)
CVE-2025-58189 CVE-2025-61725 CVE-2025-58188 CVE-2025-58185 CVE-2025-58186 CVE-2025-61723 CVE-2025-58183 CVE-2025-47912 CVE-2025-58187 CVE-2025-61724:
- bsc#1251255 CVE-2025-58189: crypto/tls: ALPN negotiation error contains attacker controlled information
- bsc#1251253 CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress
- bsc#1251260 CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys
- bsc#1251258 CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion
- bsc#1251259 CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion
- bsc#1251256 CVE-2025-61723: encoding/pem: quadratic complexity when parsing some invalid inputs
- bsc#1251261 CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map
- bsc#1251257 CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames
- bsc#1251254 CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints
- bsc#1251262 CVE-2025-61724: net/textproto: excessive CPU consumption in Reader.ReadResponse
- os: Root.OpenRoot sets incorrect name, losing prefix of original root
- debug/pe: pe.Open fails on object files produced by llvm-mingw 21
- cmd/link: panic on riscv64 with CGO enabled due to empty container symbol
- net: new test TestIPv4WriteMsgUDPAddrPortTargetAddrIPVersion fails on plan9
- os: new test TestOpenFileCreateExclDanglingSymlink fails on Plan 9
- crypto/internal/fips140/rsa: requires a panic if self-tests fail
- net/http: internal error: connCount underflow
- cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn
- sync/atomic: comment for Uintptr.Or incorrectly describes return value
Список пакетов
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Development Tools 15 SP6
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP3-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2025:3682-1
- E-Mail link for SUSE-SU-2025:3682-1
- SUSE Security Ratings
- SUSE Bug 1236217
- SUSE Bug 1251253
- SUSE Bug 1251254
- SUSE Bug 1251255
- SUSE Bug 1251256
- SUSE Bug 1251257
- SUSE Bug 1251258
- SUSE Bug 1251259
- SUSE Bug 1251260
- SUSE Bug 1251261
- SUSE Bug 1251262
- SUSE CVE CVE-2025-47912 page
- SUSE CVE CVE-2025-58183 page
- SUSE CVE CVE-2025-58185 page
- SUSE CVE CVE-2025-58186 page
- SUSE CVE CVE-2025-58187 page
- SUSE CVE CVE-2025-58188 page
Описание
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Затронутые продукты
Ссылки
- CVE-2025-47912
- SUSE Bug 1251257
Описание
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Затронутые продукты
Ссылки
- CVE-2025-58183
- SUSE Bug 1251261
Описание
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
Затронутые продукты
Ссылки
- CVE-2025-58185
- SUSE Bug 1251258
Описание
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
Затронутые продукты
Ссылки
- CVE-2025-58186
- SUSE Bug 1251259
Описание
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.
Затронутые продукты
Ссылки
- CVE-2025-58187
- SUSE Bug 1251254
Описание
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
Затронутые продукты
Ссылки
- CVE-2025-58188
- SUSE Bug 1251260
Описание
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
Затронутые продукты
Ссылки
- CVE-2025-58189
- SUSE Bug 1251255
Описание
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.
Затронутые продукты
Ссылки
- CVE-2025-61723
- SUSE Bug 1251256
Описание
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.
Затронутые продукты
Ссылки
- CVE-2025-61724
- SUSE Bug 1251262
Описание
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
Затронутые продукты
Ссылки
- CVE-2025-61725
- SUSE Bug 1251253