{"id":"CVE-2022-29804","aliases":["ALPINE-CVE-2022-29804","AZL-79118","AZL-98916","BELL-CVE-2022-29804","BIT-golang-2022-29804","EUVD-2022-34125","GHSA-4r7w-gv7f-q74g","GO-2022-0533","OESA-2022-1857","SUSE-SU-2022:2004-1","SUSE-SU-2022:2005-1","SUSE-SU-2023:2312-1","openSUSE-SU-2024:12123-1","openSUSE-SU-2024:12124-1"],"status":"published","title":"Path traversal via Clean on Windows in path/filepath","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02392,"percentile":0.84093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-06-07T14:34:31Z","modified":"2026-11-03T07:30:08Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.17.11","1.18.3"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.17.11","1.18.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.17.11"},{"introduced":"1.18.0"},{"fixed":"1.18.3"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.17.11"},{"introduced":"1.18.0-0"},{"fixed":"1.18.3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-16.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-16.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-7.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1"}]}],"bundled":4}],"products":[{"vendor":"go standard library","product":"path/filepath"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://go.dev/cl/401595","tags":["x_transferred","web","fix"]},{"url":"https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290","tags":["x_transferred","web","fix"]},{"url":"https://go.dev/issue/52476","tags":["x_transferred","web","report"]},{"url":"https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ","tags":["x_transferred","web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0533","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29804","tags":["web","advisory"]},{"url":"https://groups.google.com/g/golang-announce"},{"url":"https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg"},{"url":"https://github.com/advisories/GHSA-4r7w-gv7f-q74g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-29804","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-29804","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29804.json","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29526","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222004-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190649","tags":["report"]},{"url":"https://bugzilla.suse.com/1200134","tags":["report"]},{"url":"https://bugzilla.suse.com/1200135","tags":["report"]},{"url":"https://bugzilla.suse.com/1200136","tags":["report"]},{"url":"https://bugzilla.suse.com/1200137","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30634","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222005-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193742","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232312-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183043","tags":["report"]},{"url":"https://bugzilla.suse.com/1198423","tags":["report"]},{"url":"https://bugzilla.suse.com/1198424","tags":["report"]},{"url":"https://bugzilla.suse.com/1198427","tags":["report"]},{"url":"https://bugzilla.suse.com/1199413","tags":["report"]},{"url":"https://bugzilla.suse.com/1201434","tags":["report"]},{"url":"https://bugzilla.suse.com/1201436","tags":["report"]},{"url":"https://bugzilla.suse.com/1201437","tags":["report"]},{"url":"https://bugzilla.suse.com/1201440","tags":["report"]},{"url":"https://bugzilla.suse.com/1201443","tags":["report"]},{"url":"https://bugzilla.suse.com/1201444","tags":["report"]},{"url":"https://bugzilla.suse.com/1201445","tags":["report"]},{"url":"https://bugzilla.suse.com/1201447","tags":["report"]},{"url":"https://bugzilla.suse.com/1201448","tags":["report"]},{"url":"https://bugzilla.suse.com/1202035","tags":["report"]},{"url":"https://bugzilla.suse.com/1203185","tags":["report"]},{"url":"https://bugzilla.suse.com/1204023","tags":["report"]},{"url":"https://bugzilla.suse.com/1204024","tags":["report"]},{"url":"https://bugzilla.suse.com/1204025","tags":["report"]},{"url":"https://bugzilla.suse.com/1204941","tags":["report"]},{"url":"https://bugzilla.suse.com/1206134","tags":["report"]},{"url":"https://bugzilla.suse.com/1206135","tags":["report"]},{"url":"https://bugzilla.suse.com/1208270","tags":["report"]},{"url":"https://bugzilla.suse.com/1208271","tags":["report"]},{"url":"https://bugzilla.suse.com/1208272","tags":["report"]},{"url":"https://bugzilla.suse.com/1208491","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41725","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-29804","title":"Path traversal via Clean on Windows in path/filepath","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-09T00:00:00Z","modified":"2024-08-03T06:33:42.804Z","updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-34125","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-09T00:00:00Z","modified":"2024-08-03T06:33:42Z","updated_at":"2026-11-03T03:25:37.579336Z"}],"ghsa":[{"id":"GHSA-4r7w-gv7f-q74g","title":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath...","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-11T00:00:17Z","modified":"2023-01-29T05:05:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:45:51.862752Z"}],"nvd":[{"id":"CVE-2022-29804","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-10T20:15:34.89Z","modified":"2026-06-17T04:40:44.503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:24.750124Z"}],"osv":[{"id":"ALPINE-CVE-2022-29804","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-10T20:15:34.89Z","modified":"2026-11-03T07:30:08.304696289Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-79118","title":"CVE-2022-29804 affecting package golang 1.25.7-1","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-10T20:15:34Z","modified":"2026-04-21T04:34:38.671164Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98916","title":"CVE-2022-29804 affecting package golang 1.27.1-1","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-10T20:15:34Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2022-29804","title":"CVE-2022-29804 does not affect BellSoft software","status":"withdrawn","published":"2022-08-10T20:15:00Z","modified":"2026-01-26T09:48:20.771765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"OESA-2022-1857","title":"golang security update","description":"The Go Programming Language.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nGo before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.(CVE-2022-29526)\r\n\r\nIncorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.(CVE-2022-29804)","status":"published","published":"2022-08-26T11:05:07Z","modified":"2026-08-18T01:17:10.200967765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"BIT-golang-2022-29804","title":"Path traversal via Clean on Windows in path/filepath","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2024-03-06T11:00:46.305Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"CVE-2022-29804","title":"Path traversal via Clean on Windows in path/filepath","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.","status":"published","published":"2022-08-09T00:00:00Z","modified":"2026-10-28T02:31:14.956912042Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GO-2022-0533","title":"Path traversal via Clean on Windows in path/filepath","description":"On Windows, the filepath.Clean function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack.\n\nFor example, Clean(\".\\c:\") returns \"c:\".","status":"published","published":"2022-07-28T17:25:07Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"openSUSE-SU-2024:12123-1","title":"go1.17-1.17.11-1.1 on GA media","description":"These are all security issues fixed in the go1.17-1.17.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:29.10711Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12124-1","title":"go1.18-1.18.3-1.1 on GA media","description":"These are all security issues fixed in the go1.18-1.18.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:24.450412Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2004-1","title":"Security update for go1.17","description":"This update for go1.17 fixes the following issues:\n\nUpdate to go1.17.11 (released 2022-06-01) (bsc#1190649):\n\n- CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers (bsc#1200134).\n- CVE-2022-30629: Fixed crypto/tls session tickets lack random ticket_age_add (bsc#1200135).\n- CVE-2022-29804: Fixed path/filepath Clean(`.\\c:`) returns `c:` on Windows (bsc#1200137).\n- CVE-2022-30580: Fixed os/exec empty Cmd.Path can result in running unintended binary on Windows (bsc#1200136).\n","status":"published","published":"2022-06-07T14:34:31Z","modified":"2026-02-04T02:42:05.221104Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2005-1","title":"Security update for go1.18","description":"This update for go1.18 fixes the following issues:\n\nUpdate to go1.18.3 (released 2022-06-01) (bsc#1193742):\n\n- CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers (bsc#1200134).\n- CVE-2022-30629: Fixed crypto/tls session tickets lack random ticket_age_add (bsc#1200135).\n- CVE-2022-29804: Fixed path/filepath Clean(`.\\c:`) returns `c:` on Windows (bsc#1200137).\n- CVE-2022-30580: Fixed os/exec empty Cmd.Path can result in running unintended binary on Windows (bsc#1200136).\n","status":"published","published":"2022-06-07T14:34:56Z","modified":"2026-02-04T02:29:04.305054Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2023:2312-1","title":"Security update for go1.18-openssl","description":"This update for go1.18-openssl fixes the following issues:\n\n- Add subpackage go1.x-libstd compiled shared object libstd.so (jsc#PED-1962)\n  * Main go1.x package included libstd.so in previous versions\n  * Split libstd.so into subpackage that can be installed standalone\n  * Continues the slimming down of main go1.x package by 40 Mb\n  * Experimental and not recommended for general use, Go currently has no ABI\n  * Upstream Go has not committed to support buildmode=shared long-term\n  * Do not use in packaging, build static single binaries (the default)\n  * Upstream Go go1.x binary releases do not include libstd.so\n  * go1.x Suggests go1.x-libstd so not installed by default Recommends\n  * go1.x-libstd does not Require: go1.x so can install standalone\n  * Provides go-libstd unversioned package name\n  * Fix build step -buildmode=shared std to omit -linkshared\n- Packaging improvements:\n  * go1.x Suggests go1.x-doc so not installed by default Recommends\n  * Use Group: Development/Languages/Go instead of Other\n\n- Improvements to go1.x packaging spec:\n  * On Tumbleweed bootstrap with current default gcc13 and gccgo118\n  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap\n    using go1.x package (%bcond_without gccgo). This is no longer\n    needed on current SLE-12:Update and removing will consolidate\n    the build configurations used.\n  * Change source URLs to go.dev as per Go upstream\n  * On x86_64 export GOAMD64=v1 as per the current baseline.\n    At this time forgo GOAMD64=v3 option for x86_64_v3 support.\n  * On x86_64 %define go_amd64=v1 as current instruction baseline\n\n- Update to version 1.18.10.1 cut from the go1.18-openssl-fips\n  branch at the revision tagged go1.18.10-1-openssl-fips.\n  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips\n  * Merge go1.18.10 into dev.boringcrypto.go1.18\n\n- go1.18.10 (released 2023-01-10) includes fixes to cgo, the\n  compiler, the linker, and the crypto/x509, net/http, and syscall\n  packages.\n  Refs bsc#1193742 go1.18 release tracking\n  * go#57705 misc/cgo: backport needed for dlltool fix\n  * go#57426 crypto/x509: Verify on macOS does not return typed errors\n  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its 'old' argument.\n  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices\n  * go#57213 os: TestLstat failure on Linux Aarch64\n  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length\n  * go#57057 cmd/go: remove test dependency on gopkg.in service\n  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders\n  * go#57044 cgo: malformed DWARF TagVariable entry\n  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14\n  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused\n  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target\n  * go#56323 net/http: bad handling of HEAD requests with a body\n","status":"published","published":"2023-05-30T06:54:51Z","modified":"2026-02-04T03:20:56.665396Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}