Описание
Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21
This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
-
Switch from update-alternatives to new method.
-
Packaging improvements:
- Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install of a working go command. Refs boo#1245878 bsc#1264395
- Based on feedback from Factory maintainers restore the original lifecycle for these files: Each go1.x toolchain shares ownership of a go and gofmt symlink managed by the alternatives system (update-alternatives and libalternatives). When the last go1.x package is uninstalled the symlinks will be removed.
- Context: %ghost was introduced to prevent file conflicts among go1.x toolchain packages reported by installcheck dev tool. %ghost prevents the files from being installed, which results in no installed go command. The shared ownership of the go and gofmt symlinks is intentional.
- Define go_bootstrap_version with digits without go1.x prefix. Correct path spelling to align with current toolchain layout GOROOT_BOOTSTRAP=%{_libdir}/go/%{go_bootstrap_version}, Noting interstitial /go/ in path. Fixes bootstrap ERROR: Cannot find /usr/lib64/go1.x/bin/go. Set $GOROOT_BOOTSTRAP to a working Go tree >= Go 1.x.y. Bootstrap error first observed when using %ghost /usr/bin/go. Fixed by Eugenio Paolantonio. Refs boo#1245878 bsc#1264395
- Mark %ghost /usr/bin/go /usr/bin/gofmt to avoid file conflicts among go1.x toolchain packages. These files are managed by the alternatives system. Refs boo#1245878 bsc#1264395
Список пакетов
openSUSE Leap 16.0
go1.21-1.21.13-160000.3.1
go1.21-doc-1.21.13-160000.3.1
go1.21-race-1.21.13-160000.3.1
go1.22-1.22.12-160000.4.1
go1.22-doc-1.22.12-160000.4.1
go1.22-openssl-1.22.12-160000.4.1
go1.22-openssl-doc-1.22.12-160000.4.1
go1.22-openssl-race-1.22.12-160000.4.1
go1.22-race-1.22.12-160000.4.1
go1.23-1.23.12-160000.3.1
go1.23-doc-1.23.12-160000.3.1
go1.23-openssl-1.23.12-160000.3.1
go1.23-openssl-doc-1.23.12-160000.3.1
go1.23-openssl-race-1.23.12-160000.3.1
go1.23-race-1.23.12-160000.3.1
go1.24-1.24.13-160000.3.1
go1.24-doc-1.24.13-160000.3.1
go1.24-openssl-1.24.13-160000.3.1
go1.24-openssl-doc-1.24.13-160000.3.1
go1.24-openssl-race-1.24.13-160000.3.1
go1.24-race-1.24.13-160000.3.1
go1.25-1.25.12-160000.2.1
go1.25-doc-1.25.12-160000.2.1
go1.25-openssl-1.25.12-160000.2.1
go1.25-openssl-doc-1.25.12-160000.2.1
go1.25-openssl-race-1.25.12-160000.2.1
go1.25-race-1.25.12-160000.2.1
go1.26-1.26.5-160000.2.1
go1.26-doc-1.26.5-160000.2.1
go1.26-openssl-1.26.5-160000.2.1
go1.26-openssl-doc-1.26.5-160000.2.1
go1.26-openssl-race-1.26.5-160000.2.1
go1.26-race-1.26.5-160000.2.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1245878
- SUSE Bug 1264390
- SUSE Bug 1264391
- SUSE Bug 1264392
- SUSE Bug 1264393
- SUSE Bug 1264394
- SUSE Bug 1264395
- SUSE CVE CVE-2025-22871 page
Описание
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Затронутые продукты
openSUSE Leap 16.0:go1.21-1.21.13-160000.3.1
openSUSE Leap 16.0:go1.21-doc-1.21.13-160000.3.1
openSUSE Leap 16.0:go1.21-race-1.21.13-160000.3.1
openSUSE Leap 16.0:go1.22-1.22.12-160000.4.1
Ссылки
- CVE-2025-22871
- SUSE Bug 1240550