Описание
Security update for go1.25-openssl
This update for go1.25-openssl fixes the following issues
- Update to version go1.25.12 (bsc#1244485).
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
- CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
- CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
- CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
- CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
- CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
- CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
- CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping (bsc#1267444).
Список пакетов
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3151-1
- E-Mail link for SUSE-SU-2026:3151-1
- SUSE Security Ratings
- SUSE Bug 1244485
- SUSE Bug 1245878
- SUSE Bug 1259264
- SUSE Bug 1259265
- SUSE Bug 1259268
- SUSE Bug 1264394
- SUSE Bug 1267442
- SUSE Bug 1267444
- SUSE Bug 1267450
- SUSE Bug 1271014
- SUSE Bug 1271015
- SUSE CVE CVE-2026-25679 page
- SUSE CVE CVE-2026-27139 page
- SUSE CVE CVE-2026-27142 page
- SUSE CVE CVE-2026-27145 page
- SUSE CVE CVE-2026-39822 page
- SUSE CVE CVE-2026-42504 page
Описание
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Затронутые продукты
Ссылки
- CVE-2026-25679
- SUSE Bug 1259264
Описание
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
Затронутые продукты
Ссылки
- CVE-2026-27139
- SUSE Bug 1259268
Описание
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Затронутые продукты
Ссылки
- CVE-2026-27142
- SUSE Bug 1259265
- SUSE Bug 1264509
Описание
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Затронутые продукты
Ссылки
- CVE-2026-27145
- SUSE Bug 1267450
Описание
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Затронутые продукты
Ссылки
- CVE-2026-39822
- SUSE Bug 1271014
Описание
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Затронутые продукты
Ссылки
- CVE-2026-42504
- SUSE Bug 1267442
Описание
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
Затронутые продукты
Ссылки
- CVE-2026-42505
- SUSE Bug 1271015
Описание
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
Затронутые продукты
Ссылки
- CVE-2026-42507
- SUSE Bug 1267444