Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21447-1

Опубликовано: 27 июл. 2026
Источник: suse-cvrf

Описание

Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21

This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:

Changes in go compilers:

  • Switch from update-alternatives to new method.

  • Packaging improvements:

    • Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install of a working go command. Refs boo#1245878 bsc#1264395
    • Based on feedback from Factory maintainers restore the original lifecycle for these files: Each go1.x toolchain shares ownership of a go and gofmt symlink managed by the alternatives system (update-alternatives and libalternatives). When the last go1.x package is uninstalled the symlinks will be removed.
    • Context: %ghost was introduced to prevent file conflicts among go1.x toolchain packages reported by installcheck dev tool. %ghost prevents the files from being installed, which results in no installed go command. The shared ownership of the go and gofmt symlinks is intentional.
    • Define go_bootstrap_version with digits without go1.x prefix. Correct path spelling to align with current toolchain layout GOROOT_BOOTSTRAP=%{_libdir}/go/%{go_bootstrap_version}, Noting interstitial /go/ in path. Fixes bootstrap ERROR: Cannot find /usr/lib64/go1.x/bin/go. Set $GOROOT_BOOTSTRAP to a working Go tree >= Go 1.x.y. Bootstrap error first observed when using %ghost /usr/bin/go. Fixed by Eugenio Paolantonio. Refs boo#1245878 bsc#1264395
    • Mark %ghost /usr/bin/go /usr/bin/gofmt to avoid file conflicts among go1.x toolchain packages. These files are managed by the alternatives system. Refs boo#1245878 bsc#1264395

Список пакетов

openSUSE Leap 16.0
go1.21-1.21.13-160000.3.1
go1.21-doc-1.21.13-160000.3.1
go1.21-race-1.21.13-160000.3.1
go1.22-1.22.12-160000.4.1
go1.22-doc-1.22.12-160000.4.1
go1.22-openssl-1.22.12-160000.4.1
go1.22-openssl-doc-1.22.12-160000.4.1
go1.22-openssl-race-1.22.12-160000.4.1
go1.22-race-1.22.12-160000.4.1
go1.23-1.23.12-160000.3.1
go1.23-doc-1.23.12-160000.3.1
go1.23-openssl-1.23.12-160000.3.1
go1.23-openssl-doc-1.23.12-160000.3.1
go1.23-openssl-race-1.23.12-160000.3.1
go1.23-race-1.23.12-160000.3.1
go1.24-1.24.13-160000.3.1
go1.24-doc-1.24.13-160000.3.1
go1.24-openssl-1.24.13-160000.3.1
go1.24-openssl-doc-1.24.13-160000.3.1
go1.24-openssl-race-1.24.13-160000.3.1
go1.24-race-1.24.13-160000.3.1
go1.25-1.25.12-160000.2.1
go1.25-doc-1.25.12-160000.2.1
go1.25-openssl-1.25.12-160000.2.1
go1.25-openssl-doc-1.25.12-160000.2.1
go1.25-openssl-race-1.25.12-160000.2.1
go1.25-race-1.25.12-160000.2.1
go1.26-1.26.5-160000.2.1
go1.26-doc-1.26.5-160000.2.1
go1.26-openssl-1.26.5-160000.2.1
go1.26-openssl-doc-1.26.5-160000.2.1
go1.26-openssl-race-1.26.5-160000.2.1
go1.26-race-1.26.5-160000.2.1

Описание

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.


Затронутые продукты
openSUSE Leap 16.0:go1.21-1.21.13-160000.3.1
openSUSE Leap 16.0:go1.21-doc-1.21.13-160000.3.1
openSUSE Leap 16.0:go1.21-race-1.21.13-160000.3.1
openSUSE Leap 16.0:go1.22-1.22.12-160000.4.1

Ссылки
Уязвимость openSUSE-SU-2026:21447-1