CVE-2025-22891

When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

These are all security issues fixed in the gosec-2.24.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gosec fixes the following issues:

Changes in gosec:

• Update to version 2.25.0:

  • chore(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#1617)
  • fix: allow barry action to access secrets on fork PRs (#1616)
  • fix: reduce G117 false positives for custom marshalers and transformed values (#1614) (#1615)
  • Add barry security scanner as a step in the CI (#1612)
  • chore(deps): update all dependencies (#1611)
  • fix: prevent taint analysis hang on packages with many CHA call graph edges (#1608) (#1610)
  • Add some skills for claude code to automate some tasks (#1609)
  • Add G701-G706 rule-to-CWE mappings and CWE-117, CWE-918 entries (#1606)
  • fix: skip SSA analysis on ill-typed packages to prevent panic (#1607)
  • Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605)
  • fix(G118): eliminate false positive for package-level cancel variables (#1602)
  • feat: add G124 rule for insecure HTTP cookie configuration (#1599)
  • feat: add G709 rule for unsafe deserialization of untrusted data (#1598)
  • feat: add G708 rule for server-side template injection via text/template (#1597)
  • fix(G118): eliminate false positive when cancel is called via struct field in a closure (#1596)
  • Fix infinite recursion in interprocedural taint analysis (#1594)
  • Fix G118 false positive when cancel is stored in returned struct field (#1593)
  • Fix G118 false positive on cancel called inside goroutine closure (#1592)
  • fix(analyzer): per-package rule instantiation eliminates concurrent map crash (#1589)
  • chore(deps): update all dependencies (#1588)
  • fix(G118): treat returned cancel func as called (fixes #1584) (#1585)
  • chore(go): update supported Go versions to 1.25.8 and 1.26.1 (#1583)
  • Update the README with the correct version of the Github action for gosec (#1582)
  • chore(deps): update all dependencies (#1579)
  • Fix G115 false positives for guarded int64-to-byte conversions (#1578)
  • Update the container image migration notice (#1576)
  • chore(action): bump gosec to 2.24.7 (#1575)

• Update to version 2.24.7:

  • Ignore nosec comments in action integration workflow to generate some warnings (#1573)
  • Add a workflow for action integration test (#1571)
  • fix(sarif): avoid invalid null relationships in SARIF output (#1569)
  • chore: migrate gosec container image references to GHCR (#1567)
  • Update gorelease to use the latest cosign bundle argument (#1565)
  • Migrate goreleaser to use the proper cosign arguments (#1564)
  • Update the cosing to version v3.0.5 (#1563)
  • fix(release): use existing cosign-installer action version (#1562)
  • chore(prompts): add skill and prompt to update supported Go versions (#1561)
  • chore(prompts): add action version update skill and prompt (#1560)
  • fix(analyzers): avoid SSA dependency cycle blowups in issue #1555 paths (#1559)
  • Add a SKILL and PROMPT for fixing a GitHub issue (#1558)
  • Add a SKILL and PROMPT for generating rules with AI (#1557)
  • fix(G120): prevent hang-like analysis blowup in wrapper protection checks (#1556)
  • fix(G705): eliminate false positive when guard type cannot be resolved (#1554)
  • Remove gcmurphy from funding list
  • Extend the release workflow to push the container images also to GHCR
  • Update to gosec to v2.24.0 in the action and fix the docker image signing (#1552)

• Update to version 2.24.0:

  • fix: G704 false positive on const URL (#1551)
  • fix(G705): eliminate false positive for non-HTTP io.Writer (#1550)
  • G120: avoid false positive when MaxBytesReader is applied in middleware (#1547)
  • Fix G602 regression coverage for issue #1545 and stabilize G117 TOML test dependency (#1546)
  • taint: skip context.Context arguments during taint propagation to fix false positives (#1543)
  • test: add missing rules to formatter report tests (#1540)
  • chore(deps): update all dependencies (#1541)
  • Regenrate the TLS config rule (#1539)
  • Improve documentation (#1538) …