CVE-2025-0913

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. CVE-2025-4673. os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location - CVE-2025-0913. crypto/x509: usage of ExtKeyUsageAny disables policy validation. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon - CVE-2025-22874. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

These are all security issues fixed in the go1.23-1.23.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.24-1.24.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubecolor-0.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.24 fixes the following issues:

go1.24.4 (released 2025-06-05) includes security fixes to the crypto/x509, net/http, and os packages, as well as bug fixes to the linker, the go command, and the hash/maphash and os packages. ( bsc#1236217 go1.24 release tracking CVE-2025-22874 CVE-2025-0913 CVE-2025-4673)

• CVE-2025-22874: crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158)
• CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)
• CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)
• os: Root.Mkdir creates directories with zero permissions on OpenBSD
• hash/maphash: hashing channels with purego impl. of maphash.Comparable panics
• runtime/debug: BuildSetting does not document DefaultGODEBUG
• cmd/go: add fips140 module selection mechanism
• cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen
• CVE-2025-22873: os: Root permits access to parent directory

This update for go1.23 fixes the following issues:

go1.23.10 (released 2025-06-05) includes security fixes to the /http and os packages, as well as bug fixes to the linker. (bsc#1229122 go1.23 release tracking CVE-2025-0913 CVE-2025-4673)

• CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)

• CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)

  • runtime/debug: BuildSetting does not document DefaultGODEBUG
  • cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen

This update for go1.24-openssl fixes the following issues:

Update to version 1.24.4 (bsc#1236217):

• CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158).
• CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157).
• CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156).

This security update of go1.24-openssl fixes the following issues:

Update to version 1.24.6 cut from the go1.24-fips-release branch at the revision tagged go1.24.6-1-openssl-fips. Refs jsc#SLE-18320

• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

go1.24.6 (released 2025-08-06) includes security fixes to the database/sql and os/exec packages, as well as bug fixes to the runtime. ( boo#1236217 go1.24 release tracking)

CVE-2025-47906 CVE-2025-47907:

• go#74804 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations

• go#74833 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan

• go#73800 runtime: RSS seems to have increased in Go 1.24 while the runtime accounting has not

• go#74416 runtime: use-after-free of allpSnapshot in findRunnable

• go#74694 runtime: segfaults in runtime.(*unwinder).next

• go#74760 os/user:nolibgcc: TestGroupIdsTestUser failures

go1.24.5 (released 2025-07-08) includes security fixes to the go command, as well as bug fixes to the compiler, the linker, the , and the go command. ( boo#1236217 go1.24 release tracking) j CVE-2025-4674:

• go#74381 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module

• go#73908 runtime: bad frame pointer during panic during duffcopy

• go#74098 cmd/compile: regression on ppc64le bit operations

• go#74113 cmd/go: crash on unknown GOEXPERIMENT during toolchain selection

• go#74290 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning

• go#74294 internal/trace: stress tests triggering suspected deadlock in tracer

• go#74346 runtime: memlock not unlocked in all control flow paths in sysReserveAlignedSbrk

• go#74363 runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile

• go#74403 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN

go1.24.4 (released 2025-06-05) includes security fixes to the crypto/x509, net/http, and os packages, as well as bug fixes to the linker, the go command, and the hash/maphash and os packages. ( boo#1236217 go1.24 release tracking)

CVE-2025-22874 CVE-2025-0913 CVE-2025-4673

• go#73700 go#73702 boo#1244158 security: fix CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation

• go#73720 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows

• go#73906 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect

• go#73570 os: Root.Mkdir creates directories with zero permissions on OpenBSD

• go#73669 hash/maphash: hashing channels with purego impl. of maphash.Comparable panics

• go#73678 runtime/debug: BuildSetting does not document DefaultGODEBUG

• go#73809 cmd/go: add fips140 module selection mechanism

• go#73832 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen

This update for go1.23-openssl fixes the following issues:

Update to version 1.23.12 cut from the go1.23-fips-release branch at the revision tagged go1.23.12-1-openssl-fips. ( jsc#SLE-18320)

• Rebase to 1.23.12
• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

Packaging improvements:

• Update go_bootstrap_version to go1.21 from go1.20 to shorten the bootstrap chain. go1.21 can optionally be bootstrapped with gccgo and serve as the inital version of go1.x.
• Refs boo#1247816 bootstrap go1.21 with gccgo

go1.23.12 (released 2025-08-06) includes security fixes to the database/sql and os/exec packages, as well as bug fixes to the runtime.

CVE-2025-47906 CVE-2025-47907:

• go#74803 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations

• go#74832 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan

• go#74415 runtime: use-after-free of allpSnapshot in findRunnable

• go#74693 runtime: segfaults in runtime.(*unwinder).next

• go#74721 cmd/go: TestScript/build_trimpath_cgo fails to decode dwarf on release-branch.go1.23

• go#74726 cmd/cgo/internal/testsanitizers: failures with signal: segmentation fault or exit status 66

go1.23.11 (released 2025-07-08) includes security fixes to the go command, as well as bug fixes to the compiler, the linker, and the runtime.

CVE-2025-4674:

• go#74382 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module

• go#73907 runtime: bad frame pointer during panic during duffcopy

• go#74289 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning

• go#74293 internal/trace: stress tests triggering suspected deadlock in tracer

• go#74362 runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile

• go#74402 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN

go1.23.10 (released 2025-06-05) includes security fixes to the net/http and os packages, as well as bug fixes to the linker. (boo#1229122 go1.23 release tracking)

CVE-2025-0913 CVE-2025-4673:

• go#73719 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows

• go#73905 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect

• go#73677 runtime/debug: BuildSetting does not document DefaultGODEBUG

• go#73831 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen

go1.23.9 (released 2025-05-06) includes fixes to the runtime and the linker. (boo#1229122 go1.23 release tracking)

• go#73091 cmd/link: linkname directive on userspace variable can override runtime variable
• go#73380 runtime, x/sys/unix: Connectx is broken on darwin/amd64

go1.23.8 (released 2025-04-01) includes security fixes to the net/http package, as well as bug fixes to the runtime and the go command.

CVE-2025-22871:

• go#72010 go#71988 boo#1240550 security: fix CVE-2025-22871 net/http: reject bare LF in chunked encoding

• go#72114 runtime: process hangs for mips hardware

• go#72871 runtime: cgo callback on extra M treated as external code after nested cgo callback returns

• go#72937 internal/godebugs: winsymlink and winreadlinkvolume have incorrect defaults for Go 1.22

go1.23.7 (released 2025-03-04) includes security fixes to the net/http package, as well as bug fixes to cgo, the compiler, and the reflect, runtime, and syscall packages.

CVE-2025-22870:

• go#71985 go#71984 boo#1238572 security: fix CVE-2025-22870 net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs

• go#71727 runtime: usleep computes wrong tv_nsec on s390x

• go#71839 runtime: recover added…