Описание
Security update for go1.25
This update for go1.25 fixes the following issues
- Update to version go1.25.12 (bsc#1244485).
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
- CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
- CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
- CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
- CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
Список пакетов
Container bci/golang:1.25
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:2817-1
- E-Mail link for SUSE-SU-2026:2817-1
- SUSE Security Ratings
- SUSE Bug 1244485
- SUSE Bug 1245878
- SUSE Bug 1259264
- SUSE Bug 1259265
- SUSE Bug 1259268
- SUSE Bug 1264394
- SUSE Bug 1271014
- SUSE Bug 1271015
- SUSE CVE CVE-2026-25679 page
- SUSE CVE CVE-2026-27139 page
- SUSE CVE CVE-2026-27142 page
- SUSE CVE CVE-2026-39822 page
- SUSE CVE CVE-2026-42505 page
Описание
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Затронутые продукты
Ссылки
- CVE-2026-25679
- SUSE Bug 1259264
Описание
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
Затронутые продукты
Ссылки
- CVE-2026-27139
- SUSE Bug 1259268
Описание
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Затронутые продукты
Ссылки
- CVE-2026-27142
- SUSE Bug 1259265
- SUSE Bug 1264509
Описание
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Затронутые продукты
Ссылки
- CVE-2026-39822
- SUSE Bug 1271014
Описание
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
Затронутые продукты
Ссылки
- CVE-2026-42505
- SUSE Bug 1271015