{"id":"CVE-2023-45289","aliases":["ALSA-2024:2562","ALSA-2024:2724","ALSA-2024:3259","ALSA-2024:3346","AZL-37462","AZL-37473","AZL-78974","AZL-98628","BELL-CVE-2023-45289","BIT-golang-2023-45289","CLSA-2025-1747058667","DEBIAN-CVE-2023-45289","EUVD-2023-49588","GHSA-32ch-6x54-q4h9","GO-2024-2600","OESA-2024-1306","RHSA-2024:0045","RHSA-2024:2562","RHSA-2024:2724","RHSA-2024:3259","RHSA-2024:3346","RHSA-2024:4023","RLSA-2024:2724","RLSA-2024:3346","SUSE-SU-2024:0800-1","SUSE-SU-2024:0811-1","SUSE-SU-2024:0812-1","SUSE-SU-2024:0936-1","SUSE-SU-2024:3089-1","SUSE-SU-2024:3755-1","SUSE-SU-2024:3772-1","SUSE-SU-2024:3938-1","SUSE-SU-2026:4585-1","SUSE-SU-2026:4606-1","UBUNTU-CVE-2023-45289","USN-6886-1","openSUSE-SU-2024:13752-1","openSUSE-SU-2024:13756-1","openSUSE-SU-2026:11436-1"],"status":"published","title":"Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0108,"percentile":0.6555,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-03-05T22:15:02Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.21.6-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"go","fixed_in":["1.21.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"go","fixed_in":["1.22.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"go","fixed_in":["1.21.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"go","fixed_in":["1.22.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.21.8","1.22.1"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.21.8","1.22.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","fixed_in":["1.21.1-1~ubuntu20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","fixed_in":["1.21.1-1~ubuntu22.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-2.el9_4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3.module_el8.10.0+3760+4dd778f9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1.module_el8.10.0+3840+edaca3c3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1.module_el8.10.0+3840+edaca3c3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1.module_el8.10.0+3840+edaca3c3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1.module_el8.10.0+3840+edaca3c3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1.module_el8.10.0+3840+edaca3c3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1.module_el8.10.0+3840+edaca3c3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1.module_el8.10.0+3840+edaca3c3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.21.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.22.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.21.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.22.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.8"},{"introduced":"1.22.0-0"},{"fixed":"1.22.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.8"},{"introduced":"1.22.0-0"},{"fixed":"1.22.1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-39.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-39.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-28.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-28.oe2203sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-28.oe2203sp2"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-28.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.33.1-6.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python3-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.33.1-6.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404301345.p0.g0e95532.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404301345.p0.g0e95532.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404181812.p0.g26b43df.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-15.2.gitd5383c5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-15.2.gitd5383c5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202405311136.p0.ga53e9de.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404181812.p0.g26b43df.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-2.el9_4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el9_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el9_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el9_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-3.module+el8.10.0+21244+5b2d9000"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-3.module+el8.10.0+21244+5b2d9000"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-3.module+el8.10.0+21244+5b2d9000"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-1.module+el8.10.0+21671+b35c3b78"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-1.module+el8.10.0+21671+b35c3b78"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-1.module+el8.10.0+21671+b35c3b78"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-1.module+el8.10.0+21671+b35c3b78"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-1.module+el8.10.0+21671+b35c3b78"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-1.module+el8.10.0+21671+b35c3b78"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.9-1.module+el8.10.0+21671+b35c3b78"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.0-7.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el9_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-150000.1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-150000.1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-150000.1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-150000.1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-150000.1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-150000.1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-150000.1.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-150000.1.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"go1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-1.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150000.1.11.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150000.1.11.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150000.1.11.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150000.1.11.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150000.1.11.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150000.1.11.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150600.16.3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13.1-150600.16.3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.22-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.7.1-150000.1.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.22-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.7.1-150000.1.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"go1.22-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.7.1-150600.13.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"go1.22-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.7.1-150600.13.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150002.3.19.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150002.4.27.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-150002.3.15.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150100.4.40.2"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu20.04.3"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu22.04.3"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu20.04.3"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu22.04.3"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2~22.04.1"}]}],"versions":["1.22.2-2~22.04"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-1ubuntu0.1"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2ubuntu0.1"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-1.1"}]}],"bundled":4}],"products":[{"vendor":"go standard library","product":"net/http"},{"vendor":"go standard library","product":"net/http/cookiejar"}],"references":[{"url":"https://go.dev/issue/65065","tags":["x_transferred","web","report"]},{"url":"https://go.dev/cl/569340","tags":["x_transferred","web","fix","report"]},{"url":"https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","tags":["x_transferred","web","article","report"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2600","tags":["x_transferred","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0006/","tags":["x_transferred","web","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/4","tags":["x_transferred","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45289","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0006"},{"url":"https://github.com/advisories/GHSA-32ch-6x54-q4h9"},{"url":"https://access.redhat.com/errata/RHSA-2024:2562","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45288","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45289","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45290","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1394","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24783","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24784","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24785","tags":["report"]},{"url":"https://bugzilla.redhat.com/2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268017","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268022","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268273","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2562.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2724","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2724.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3259","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3259.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3346","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3346.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-45289","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-21","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1747058667.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45289","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24785","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0045","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274767","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0045.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29483","tags":["advisory"]},{"url":"https://www.dnspython.org/news/2.6.0rc1/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45289","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45290","tags":["advisory"]},{"url":"https://go.dev/cl/569341","tags":["article"]},{"url":"https://go.dev/issue/65383","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2599","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0004","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3727","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24783","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3q2c-pvp5-3cqp","tags":["advisory"]},{"url":"https://go.dev/cl/569339","tags":["article"]},{"url":"https://go.dev/issue/65390","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2598","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0005","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24784","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24785","tags":["advisory"]},{"url":"https://go.dev/cl/564196","tags":["article"]},{"url":"https://go.dev/issue/65697","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2024-2610.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","tags":["advisory"]},{"url":"https://go.dev/cl/569356","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28176","tags":["advisory"]},{"url":"https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268273","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2562.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","tags":["advisory"]},{"url":"https://nowotarski.info/http2-continuation-flood/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2687","tags":["advisory"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1394","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136","tags":["article"]},{"url":"https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6","tags":["article"]},{"url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2660","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2024-2660.json","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2724.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3259.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3346.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4023","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277862","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4023.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2724","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3346","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240800-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212475","tags":["report"]},{"url":"https://bugzilla.suse.com/1219988","tags":["report"]},{"url":"https://bugzilla.suse.com/1220999","tags":["report"]},{"url":"https://bugzilla.suse.com/1221000","tags":["report"]},{"url":"https://bugzilla.suse.com/1221001","tags":["report"]},{"url":"https://bugzilla.suse.com/1221002","tags":["report"]},{"url":"https://bugzilla.suse.com/1221003","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24785","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240811-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240812-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218424","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240936-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243089-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221400","tags":["report"]},{"url":"https://bugzilla.suse.com/1224017","tags":["report"]},{"url":"https://bugzilla.suse.com/1225973","tags":["report"]},{"url":"https://bugzilla.suse.com/1225974","tags":["report"]},{"url":"https://bugzilla.suse.com/1227314","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24791","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243755-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243772-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224018","tags":["report"]},{"url":"https://bugzilla.suse.com/1230252","tags":["report"]},{"url":"https://bugzilla.suse.com/1230253","tags":["report"]},{"url":"https://bugzilla.suse.com/1230254","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34158","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243938-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218722","tags":["report"]},{"url":"https://bugzilla.suse.com/1230949","tags":["report"]},{"url":"https://bugzilla.suse.com/1252286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254400","tags":["report"]},{"url":"https://bugzilla.suse.com/1257151","tags":["report"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1262319","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262654","tags":["report"]},{"url":"https://bugzilla.suse.com/1262803","tags":["report"]},{"url":"https://bugzilla.suse.com/1263254","tags":["report"]},{"url":"https://bugzilla.suse.com/1263330","tags":["report"]},{"url":"https://bugzilla.suse.com/1263442","tags":["report"]},{"url":"https://bugzilla.suse.com/1263822","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265267","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1265413","tags":["report"]},{"url":"https://bugzilla.suse.com/1265525","tags":["report"]},{"url":"https://bugzilla.suse.com/1265763","tags":["report"]},{"url":"https://bugzilla.suse.com/1266481","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267261","tags":["report"]},{"url":"https://bugzilla.suse.com/1267528","tags":["report"]},{"url":"https://bugzilla.suse.com/1267534","tags":["report"]},{"url":"https://bugzilla.suse.com/1267538","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1267980","tags":["report"]},{"url":"https://bugzilla.suse.com/1268325","tags":["report"]},{"url":"https://bugzilla.suse.com/1268395","tags":["report"]},{"url":"https://bugzilla.suse.com/1268396","tags":["report"]},{"url":"https://bugzilla.suse.com/1268397","tags":["report"]},{"url":"https://bugzilla.suse.com/1268649","tags":["report"]},{"url":"https://bugzilla.suse.com/1268755","tags":["report"]},{"url":"https://bugzilla.suse.com/1268868","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269841","tags":["report"]},{"url":"https://bugzilla.suse.com/1269856","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1269966","tags":["report"]},{"url":"https://bugzilla.suse.com/1270033","tags":["report"]},{"url":"https://bugzilla.suse.com/1270285","tags":["report"]},{"url":"https://bugzilla.suse.com/1270398","tags":["report"]},{"url":"https://bugzilla.suse.com/1270399","tags":["report"]},{"url":"https://bugzilla.suse.com/1270711","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://bugzilla.suse.com/1271330","tags":["report"]},{"url":"https://bugzilla.suse.com/1271428","tags":["report"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://bugzilla.suse.com/1271613","tags":["report"]},{"url":"https://bugzilla.suse.com/1272008","tags":["report"]},{"url":"https://bugzilla.suse.com/1272102","tags":["report"]},{"url":"https://bugzilla.suse.com/1272328","tags":["report"]},{"url":"https://bugzilla.suse.com/1272427","tags":["report"]},{"url":"https://bugzilla.suse.com/1273094","tags":["report"]},{"url":"https://bugzilla.suse.com/1273144","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://bugzilla.suse.com/1275205","tags":["report"]},{"url":"https://bugzilla.suse.com/1275206","tags":["report"]},{"url":"https://bugzilla.suse.com/1275207","tags":["report"]},{"url":"https://bugzilla.suse.com/1275934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276426","tags":["report"]},{"url":"https://bugzilla.suse.com/1276658","tags":["report"]},{"url":"https://bugzilla.suse.com/1276973","tags":["report"]},{"url":"https://bugzilla.suse.com/1277025","tags":["report"]},{"url":"https://bugzilla.suse.com/1278307","tags":["report"]},{"url":"https://bugzilla.suse.com/1278322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264606-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45289","tags":["report"]},{"url":"https://github.com/golang/go/issues/65065","tags":["report"]},{"url":"https://github.com/golang/go/commit/3a855208e3efed2e9d7c20ad023f1fa78afcc0be","tags":["report"]},{"url":"https://github.com/golang/go/commit/20586c0dbe03d144f914155f879fa5ee287591a1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6886-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24790","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-45289","title":"Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T22:22:30.306Z","modified":"2025-02-13T17:14:01.755Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49588","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T22:22:30Z","modified":"2025-02-13T17:14:01Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-32ch-6x54-q4h9","title":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the...","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-06T00:31:26Z","modified":"2024-11-04T21:31:29Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:58:43.210342Z"}],"nvd":[{"id":"CVE-2023-45289","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:07.137Z","modified":"2026-06-17T06:28:35.857Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:09:10.192572Z"}],"osv":[{"id":"BELL-CVE-2023-45289","status":"published","published":"2024-03-07T05:56:44.474906Z","modified":"2026-01-26T09:35:32.22562Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-45289","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:07.137Z","modified":"2026-10-26T18:02:49.711358935Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-1306","title":"golang security update","description":" The Go Programming Language.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \u0026quot;Authorization\u0026quot; or \u0026quot;Cookie\u0026quot;. For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.(CVE-2023-45289)\r\n\r\nWhen parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.(CVE-2023-45290)\r\n\r\nVerifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.(CVE-2024-24783)\r\n\r\nIf errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)","status":"published","published":"2024-03-22T11:06:45Z","modified":"2026-08-18T01:18:19.450727817Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:0045","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.0 security update","status":"published","published":"2024-10-02T11:03:00Z","modified":"2026-10-20T10:02:28Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:2562","title":"Red Hat Security Advisory: golang security update","status":"published","published":"2024-10-02T11:01:46Z","modified":"2026-10-16T10:04:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2724","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2024-10-02T11:02:06Z","modified":"2026-10-16T10:04:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3259","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","status":"published","published":"2024-10-21T18:51:05Z","modified":"2026-10-16T10:04:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3346","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2024-10-02T11:02:44Z","modified":"2026-10-16T10:04:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:4023","title":"Red Hat Security Advisory: Release of openshift-serverless-clients kn 1.33.0 security update \u0026 enhancements","status":"published","published":"2024-10-02T11:03:43Z","modified":"2026-10-16T10:04:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2023-45289","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:00Z","modified":"2026-10-06T23:30:56.185434764Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2562","title":"Important: golang security update","description":"The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n* golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)\n* golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:44.091839938Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:2724","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-07T00:00:00Z","modified":"2026-10-29T11:31:45.263592826Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3259","title":"Important: go-toolset:rhel8 security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n* golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)\n* golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:21.161557928Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3346","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-23T00:00:00Z","modified":"2026-10-29T11:02:21.056208626Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-37462","title":"CVE-2023-45289 affecting package golang for versions less than 1.21.6-1","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:07Z","modified":"2026-04-21T04:28:20.742609Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37473","title":"CVE-2023-45289 affecting package golang for versions less than 1.21.6-1","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:07Z","modified":"2026-04-21T04:28:20.941065Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-78974","title":"CVE-2023-45289 affecting package golang 1.26.10-1","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:07Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-98628","title":"CVE-2023-45289 affecting package golang 1.27.1-1","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:07Z","modified":"2026-09-16T06:39:01Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BIT-golang-2023-45289","title":"Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-12T08:24:51.862Z","modified":"2026-01-28T03:27:20.066136Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2025-1747058667","title":"golang: Fix of 2 CVEs","description":"- CVE-2024-45336: fix potential sending of sensitive headers in\n  chain of redirections\n- CVE-2023-45289: fix potential sending of sensitive headers and\n  cookies on IPv6 zones","status":"published","published":"2025-05-12T14:04:32Z","modified":"2026-10-21T10:45:29.589006471Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CVE-2023-45289","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T23:15:07Z","modified":"2026-10-10T11:47:18.072110136Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GO-2024-2600","title":"Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not.\n\nA maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.","status":"published","published":"2024-03-05T22:15:02Z","modified":"2026-02-04T02:34:41.672789Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2024:13752-1","title":"go1.22-1.22.1-1.1 on GA media","description":"These are all security issues fixed in the go1.22-1.22.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:09.301922Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13756-1","title":"go1.21-1.21.8-1.1 on GA media","description":"These are all security issues fixed in the go1.21-1.21.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:59:43.978309Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11436-1","title":"golang-github-prometheus-prometheus-3.13.2-1.1 on GA media","description":"These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-02T00:00:00Z","modified":"2026-08-03T10:30:30.476636995Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"RLSA-2024:2724","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-10T14:32:42.380544Z","modified":"2026-02-05T04:30:13.197582Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2024:3346","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-14T13:59:30.118978Z","modified":"2026-02-04T23:15:05.096283Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:0800-1","title":"Security update for go1.21","description":"This update for go1.21 fixes the following issues:\n\n- Upgrade go to version 1.21.8\n- CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000)\n- CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)\n- CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999)\n- CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)\n- CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)\n","status":"published","published":"2024-03-07T09:35:01Z","modified":"2026-02-04T03:05:50.962508Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0811-1","title":"Security update for go1.21","description":"This update for go1.21 fixes the following issues:\n\n- Upgrade go to version 1.21.8\n- CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000)\n- CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)\n- CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999)\n- CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)\n- CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)\n","status":"published","published":"2024-03-08T07:43:13Z","modified":"2025-05-02T04:35:33.921491Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0812-1","title":"Security update for go1.22","description":"This update for go1.22 fixes the following issues:\n\n- Upgrade go to version 1.22.1\n- CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000)\n- CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)\n- CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999)\n- CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)\n- CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)\n","status":"published","published":"2024-03-08T07:43:32Z","modified":"2026-02-04T03:36:35.393327Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0936-1","title":"Security update for go1.22","description":"This update for go1.22 fixes the following issues:\n\n\n- go1.22.1 (released 2024-03-05) includes security fixes to the\n  crypto/x509, html/template, net/http, net/http/cookiejar, and\n  net/mail packages, as well as bug fixes to the compiler, the go\n  command, the runtime, the trace command, and the go/types and\n  net/http packages. (bsc#1218424)\n\n  CVE-2023-45289 CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24785\n\n  * go#65831 go#65390 bsc#1220999 security: fix CVE-2024-24783 crypto/x509: Verify panics on certificates with an unknown public key algorithm\n  * go#65849 go#65083 bsc#1221002 security: fix CVE-2024-24784 net/mail: comments in display names are incorrectly handled\n  * go#65850 go#65383 bsc#1221001 security: fix CVE-2023-45290 net/http: memory exhaustion in Request.ParseMultipartForm\n  * go#65859 go#65065 bsc#1221000 security: fix CVE-2023-45289 net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect\n  * go#65969 go#65697 bsc#1221003 security: fix CVE-2024-24785 html/template: errors returned from MarshalJSON methods may break template escaping\n  * go#65352 cmd/go: go generate fails silently when run on a package in a nested workspace module\n  * go#65471 internal/testenv: TestHasGoBuild failures on the LUCI noopt builders\n  * go#65474 internal/testenv: support LUCI mobile builders in testenv tests\n  * go#65577 cmd/trace/v2: goroutine analysis page doesn't identify goroutines consistently\n  * go#65618 cmd/compile: Go 1.22 build fails with 1.21 PGO profile on internal/saferio change\n  * go#65619 cmd/compile: Go 1.22 changes support for modules that declare go 1.0\n  * go#65641 cmd/cgo/internal/testsanitizers,x/build: LUCI clang15 builders failing\n  * go#65644 runtime: crash in race detector when execution tracer reads from CPU profile buffer\n  * go#65728 go/types: nil pointer dereference in Alias.Underlying()\n  * go#65759 net/http: context cancellation can leave HTTP client with deadlocked HTTP/1.1 connections in Go1.22\n  * go#65760 runtime: Go 1.22.0 fails to build from source on armv7 Alpine Linux\n  * go#65818 runtime: go1.22.0 test with -race will SIGSEGV or SIGBUS or Bad Pointer\n  * go#65852 cmd/go: 'missing ziphash' error with go.work\n  * go#65883 runtime: scheduler sometimes starves a runnable goroutine on wasm platforms\n\n- Packaging improvements:\n  * bsc#1219988 ensure VERSION file is present in GOROOT\n    as required by go tool dist and go tool distpack\n\n- go1.22 (released 2024-02-06) is a major release of Go.\n  go1.22.x minor releases will be provided through February 2024.\n  https://github.com/golang/go/wiki/Go-Release-Cycle\n  go1.22 arrives six months after go1.21. Most of its changes are\n  in the implementation of the toolchain, runtime, and libraries.\n  As always, the release maintains the Go 1 promise of\n  compatibility. We expect almost all Go programs to continue to\n  compile and run as before. (bsc#1218424)\n  * Language change: go1.22 makes two changes to for loops.\n    Previously, the variables declared by a for loop were created\n    once and updated by each iteration. In go1.22, each iteration\n    of the loop creates new variables, to avoid accidental sharing\n    bugs. The transition support tooling described in the proposal\n    continues to work in the same way it did in Go 1.21.\n  * Language change: For loops may now range over integers\n  * Language change: go1.22 includes a preview of a language change\n    we are considering for a future version of Go:\n    range-over-function iterators. Building with\n    GOEXPERIMENT=rangefunc enables this feature.\n  * go command: Commands in workspaces can now use a vendor\n    directory containing the dependencies of the workspace. The\n    directory is created by go work vendor, and used by build\n    commands when the -mod flag is set to vendor, which is the\n    default when a workspace vendor directory is present.  Note\n    that the vendor directory's contents for a workspace are\n    different from those of a single module: if the directory at\n    the root of a workspace also contains one of the modules in the\n    workspace, its vendor directory can contain the dependencies of\n    either the workspace or of the module, but not both.\n  * go get is no longer supported outside of a module in the legacy\n    GOPATH mode (that is, with GO111MODULE=off). Other build\n    commands, such as go build and go test, will continue to work\n    indefinitely for legacy GOPATH programs.\n  * go mod init no longer attempts to import module requirements\n    from configuration files for other vendoring tools (such as\n    Gopkg.lock).\n  * go test -cover now prints coverage summaries for covered\n    packages that do not have their own test files. Prior to Go\n    1.22 a go test -cover run for such a package would report: ?\n    mymod/mypack [no test files] and now with go1.22, functions in\n    the package are treated as uncovered: mymod/mypack coverage:\n    0.0% of statements Note that if a package contains no\n    executable code at all, we can't report a meaningful coverage\n    percentage; for such packages the go tool will continue to\n    report that there are no test files.\n  * trace: The trace tool's web UI has been gently refreshed as\n    part of the work to support the new tracer, resolving several\n    issues and improving the readability of various sub-pages. The\n    web UI now supports exploring traces in a thread-oriented\n    view. The trace viewer also now displays the full duration of\n    all system calls.  These improvements only apply for viewing\n    traces produced by programs built with go1.22 or newer. A\n    future release will bring some of these improvements to traces\n    produced by older version of Go.\n  * vet: References to loop variables The behavior of the vet tool\n    has changed to match the new semantics (see above) of loop\n    variables in go1.22. When analyzing a file that requires go1.22\n    or newer (due to its go.mod file or a per-file build\n    constraint), vetcode\u003e no longer reports references to loop\n    variables from within a function literal that might outlive the\n    iteration of the loop. In Go 1.22, loop variables are created\n    anew for each iteration, so such references are no longer at\n    risk of using a variable after it has been updated by the loop.\n  * vet: New warnings for missing values after append The vet tool\n    now reports calls to append that pass no values to be appended\n    to the slice, such as slice = append(slice). Such a statement\n    has no effect, and experience has shown that is nearly always a\n    mistake.\n  * vet: New warnings for deferring time.Since The vet tool now\n    reports a non-deferred call to time.Since(t) within a defer\n    statement. This is equivalent to calling time.Now().Sub(t)\n    before the defer statement, not when the deferred function is\n    called. In nearly all cases, the correct code requires\n    deferring the time.Since call.\n  * vet: New warnings for mismatched key-value pairs in log/slog\n    calls The vet tool now reports invalid arguments in calls to\n    functions and methods in the structured logging package,\n    log/slog, that accept alternating key/value pairs. It reports\n    calls where an argument in a key position is neither a string\n    nor a slog.Attr, and where a final key is missing its value.\n  * runtime: The runtime now keeps type-based garbage collection\n    metadata nearer to each heap object, improving the CPU\n    performance (latency or throughput) of Go programs by\n    1-3%. This change also reduces the memory overhead of the\n    majority Go programs by approximately 1% by deduplicating\n    redundant metadata. Some programs may see a smaller improvement\n    because this change adjusts the size class boundaries of the\n    memory allocator, so some objects may be moved up a size class.\n    A consequence of this change is that some objects' addresses\n    that were previously always aligned to a 16 byte (or higher)\n    boundary will now only be aligned to an 8 byte boundary. Some\n    programs that use assembly instructions that require memory\n    addresses to be more than 8-byte aligned and rely on the memory\n    allocator's previous alignment behavior may break, but we\n    expect such programs to be rare. Such programs may be built\n    with GOEXPERIMENT=noallocheaders to revert to the old metadata\n    layout and restore the previous alignment behavior, but package\n    owners should update their assembly code to avoid the alignment\n    assumption, as this workaround will be removed in a future\n    release.\n  * runtime: On the windows/amd64 port, programs linking or loading\n    Go libraries built with -buildmode=c-archive or\n    -buildmode=c-shared can now use the SetUnhandledExceptionFilter\n    Win32 function to catch exceptions not handled by the Go\n    runtime. Note that this was already supported on the\n    windows/386 port.\n  * compiler: Profile-guided Optimization (PGO) builds can now\n    devirtualize a higher proportion of calls than previously\n    possible. Most programs from a representative set of Go\n    programs now see between 2 and 14% improvement from enabling\n    PGO.\n  * compiler: The compiler now interleaves devirtualization and\n    inlining, so interface method calls are better optimized.\n  * compiler: go1.22 also includes a preview of an enhanced\n    implementation of the compiler's inlining phase that uses\n    heuristics to boost inlinability at call sites deemed\n    'important' (for example, in loops) and discourage inlining at\n    call sites deemed 'unimportant' (for example, on panic\n    paths). Building with GOEXPERIMENT=newinliner enables the new\n    call-site heuristics; see issue #61502 for more info and to\n    provide feedback.\n  * linker: The linker's -s and -w flags are now behave more\n    consistently across all platforms. The -w flag suppresses DWARF\n    debug information generation. The -s flag suppresses symbol\n    table generation. The -s flag also implies the -w flag, which\n    can be negated with -w=0. That is, -s -w=0 will generate a\n    binary with DWARF debug information generation but without the\n    symbol table.\n  * linker: On ELF platforms, the -B linker flag now accepts a\n    special form: with -B gobuildid, the linker will generate a GNU\n    build ID (the ELF NT_GNU_BUILD_ID note) derived from the Go\n    build ID.\n  * linker: On Windows, when building with -linkmode=internal, the\n    linker now preserves SEH information from C object files by\n    copying the .pdata and .xdata sections into the final\n    binary. This helps with debugging and profiling binaries using\n    native tools, such as WinDbg. Note that until now, C functions'\n    SEH exception handlers were not being honored, so this change\n    may cause some programs to behave differently.\n    -linkmode=external is not affected by this change, as external\n    linkers already preserve SEH information.\n  * bootstrap: As mentioned in the Go 1.20 release notes, go1.22\n    now requires the final point release of Go 1.20 or later for\n    bootstrap. We expect that Go 1.24 will require the final point\n    release of go1.22 or later for bootstrap.\n  * core library: New math/rand/v2 package: go1.22 includes the\n    first “v2” package in the standard library, math/rand/v2. The\n    changes compared to math/rand are detailed in proposal\n    go#61716. The most important changes are:\n    - The Read method, deprecated in math/rand, was not carried\n      forward for math/rand/v2. (It remains available in\n      math/rand.) The vast majority of calls to Read should use\n      crypto/rand’s Read instead. Otherwise a custom Read can be\n      constructed using the Uint64 method.\n    - The global generator accessed by top-level functions is\n      unconditionally randomly seeded. Because the API guarantees\n      no fixed sequence of results, optimizations like per-thread\n      random generator states are now possible.\n    - The Source interface now has a single Uint64 method; there is\n      no Source64 interface.\n    - Many methods now use faster algorithms that were not possible\n      to adopt in math/rand because they changed the output\n      streams.\n    - The Intn, Int31, Int31n, Int63, and Int64n top-level\n      functions and methods from math/rand are spelled more\n      idiomatically in math/rand/v2: IntN, Int32, Int32N, Int64,\n      and Int64N. There are also new top-level functions and\n      methods Uint32, Uint32N, Uint64, Uint64N, Uint, and UintN.\n    - The new generic function N is like Int64N or Uint64N but\n      works for any integer type. For example a random duration\n      from 0 up to 5 minutes is rand.N(5*time.Minute).\n    - The Mitchell \u0026 Reeds LFSR generator provided by math/rand’s\n      Source has been replaced by two more modern pseudo-random\n      generator sources: ChaCha8 PCG. ChaCha8 is a new,\n      cryptographically strong random number generator roughly\n      similar to PCG in efficiency. ChaCha8 is the algorithm used\n      for the top-level functions in math/rand/v2. As of go1.22,\n      math/rand's top-level functions (when not explicitly seeded)\n      and the Go runtime also use ChaCha8 for randomness.\n    - We plan to include an API migration tool in a future release,\n      likely Go 1.23.\n  * core library: New go/version package: The new go/version\n    package implements functions for validating and comparing Go\n    version strings.\n  * core library: Enhanced routing patterns: HTTP routing in the\n    standard library is now more expressive. The patterns used by\n    net/http.ServeMux have been enhanced to accept methods and\n    wildcards. This change breaks backwards compatibility in small\n    ways, some obvious—patterns with '{' and '}' behave\n    differently— and some less so—treatment of escaped paths has\n    been improved. The change is controlled by a GODEBUG field\n    named httpmuxgo121. Set httpmuxgo121=1 to restore the old\n    behavior.\n  * Minor changes to the library As always, there are various minor\n    changes and updates to the library, made with the Go 1 promise\n    of compatibility in mind. There are also various performance\n    improvements, not enumerated here.\n  * archive/tar: The new method Writer.AddFS adds all of the files\n    from an fs.FS to the archive.\n  * archive/zip: The new method Writer.AddFS adds all of the files\n    from an fs.FS to the archive.\n  * bufio: When a SplitFunc returns ErrFinalToken with a nil token,\n    Scanner will now stop immediately. Previously, it would report\n    a final empty token before stopping, which was usually not\n    desired. Callers that do want to report a final empty token can\n    do so by returning []byte{} rather than nil.\n  * cmp: The new function Or returns the first in a sequence of\n    values that is not the zero value.\n  * crypto/tls: ConnectionState.ExportKeyingMaterial will now\n    return an error unless TLS 1.3 is in use, or the\n    extended_master_secret extension is supported by both the\n    server and client. crypto/tls has supported this extension\n    since Go 1.20. This can be disabled with the tlsunsafeekm=1\n    GODEBUG setting.\n  * crypto/tls: By default, the minimum version offered by\n    crypto/tls servers is now TLS 1.2 if not specified with\n    config.MinimumVersion, matching the behavior of crypto/tls\n    clients. This change can be reverted with the tls10server=1\n    GODEBUG setting.\n  * crypto/tls: By default, cipher suites without ECDHE support are\n    no longer offered by either clients or servers during pre-TLS\n    1.3 handshakes. This change can be reverted with the\n    tlsrsakex=1 GODEBUG setting.\n  * crypto/x509: The new CertPool.AddCertWithConstraint method can\n    be used to add customized constraints to root certificates to\n    be applied during chain building.\n  * crypto/x509: On Android, root certificates will now be loaded\n    from /data/misc/keychain/certs-added as well as\n    /system/etc/security/cacerts.\n  * crypto/x509: A new type, OID, supports ASN.1 Object Identifiers\n    with individual components larger than 31 bits. A new field\n    which uses this type, Policies, is added to the Certificate\n    struct, and is now populated during parsing. Any OIDs which\n    cannot be represented using a asn1.ObjectIdentifier will appear\n    in Policies, but not in the old PolicyIdentifiers field. When\n    calling CreateCertificate, the Policies field is ignored, and\n    policies are taken from the PolicyIdentifiers field. Using the\n    x509usepolicies=1 GODEBUG setting inverts this, populating\n    certificate policies from the Policies field, and ignoring the\n    PolicyIdentifiers field. We may change the default value of\n    x509usepolicies in Go 1.23, making Policies the default field\n    for marshaling.\n  * database/sql: The new Null[T] type provide a way to scan\n    nullable columns for any column types.\n  * debug/elf: Constant R_MIPS_PC32 is defined for use with MIPS64\n    systems. Additional R_LARCH_* constants are defined for use\n    with LoongArch systems.\n  * encoding: The new methods AppendEncode and AppendDecode added\n    to each of the Encoding types in the packages encoding/base32,\n    encoding/base64, and encoding/hex simplify encoding and\n    decoding from and to byte slices by taking care of byte slice\n    buffer management.\n  * encoding: The methods base32.Encoding.WithPadding and\n    base64.Encoding.WithPadding now panic if the padding argument\n    is a negative value other than NoPadding.\n  * encoding/json: Marshaling and encoding functionality now\n    escapes '\\b' and '\\f' characters as \\b and \\f instead of \\u0008\n    and \\u000c.\n  * go/ast: The following declarations related to syntactic\n    identifier resolution are now deprecated: Ident.Obj, Object,\n    Scope, File.Scope, File.Unresolved, Importer, Package,\n    NewPackage. In general, identifiers cannot be accurately\n    resolved without type information. Consider, for example, the\n    identifier K in T{K: ''}: it could be the name of a local\n    variable if T is a map type, or the name of a field if T is a\n    struct type. New programs should use the go/types package to\n    resolve identifiers; see Object, Info.Uses, and Info.Defs for\n    details.\n  * go/ast: The new ast.Unparen function removes any enclosing\n    parentheses from an expression.\n  * go/types: The new Alias type represents type\n    aliases. Previously, type aliases were not represented\n    explicitly, so a reference to a type alias was equivalent to\n    spelling out the aliased type, and the name of the alias was\n    lost. The new representation retains the intermediate\n    Alias. This enables improved error reporting (the name of a\n    type alias can be reported), and allows for better handling of\n    cyclic type declarations involving type aliases. In a future\n    release, Alias types will also carry type parameter\n    information. The new function Unalias returns the actual type\n    denoted by an Alias type (or any other Type for that matter).\n  * go/types: Because Alias types may break existing type switches\n    that do not know to check for them, this functionality is\n    controlled by a GODEBUG field named gotypesalias. With\n    gotypesalias=0, everything behaves as before, and Alias types\n    are never created. With gotypesalias=1, Alias types are created\n    and clients must expect them. The default is gotypesalias=0. In\n    a future release, the default will be changed to\n    gotypesalias=1. Clients of go/types are urged to adjust their\n    code as soon as possible to work with gotypesalias=1 to\n    eliminate problems early.\n  * go/types: The Info struct now exports the FileVersions map\n    which provides per-file Go version information.\n  * go/types: The new helper method PkgNameOf returns the local\n    package name for the given import declaration.\n  * go/types: The implementation of SizesFor has been adjusted to\n    compute the same type sizes as the compiler when the compiler\n    argument for SizesFor is 'gc'. The default Sizes implementation\n    used by the type checker is now types.SizesFor('gc', 'amd64').\n  * go/types: The start position (Pos) of the lexical environment\n    block (Scope) that represents a function body has changed: it\n    used to start at the opening curly brace of the function body,\n    but now starts at the function's func token.\n  * html/template: Javascript template literals may now contain Go\n    template actions, and parsing a template containing one will no\n    longer return ErrJSTemplate. Similarly the GODEBUG setting\n    jstmpllitinterp no longer has any effect.\n  * io: The new SectionReader.Outer method returns the ReaderAt,\n    offset, and size passed to NewSectionReader.\n  * log/slog: The new SetLogLoggerLevel function controls the level\n    for the bridge between the `slog` and `log` packages. It sets\n    the minimum level for calls to the top-level `slog` logging\n    functions, and it sets the level for calls to `log.Logger` that\n    go through `slog`.\n  * math/big: The new method Rat.FloatPrec computes the number of\n    fractional decimal digits required to represent a rational\n    number accurately as a floating-point number, and whether\n    accurate decimal representation is possible in the first place.\n  * net: When io.Copy copies from a TCPConn to a UnixConn, it will\n    now use Linux's splice(2) system call if possible, using the\n    new method TCPConn.WriteTo.\n  * net: The Go DNS Resolver, used when building with\n    '-tags=netgo', now searches for a matching name in the Windows\n    hosts file, located at %SystemRoot%\\System32\\drivers\\etc\\hosts,\n    before making a DNS query.\n  * net/http: The new functions ServeFileFS, FileServerFS, and\n    NewFileTransportFS are versions of the existing ServeFile,\n    FileServer, and NewFileTransport, operating on an fs.FS.\n  * net/http: The HTTP server and client now reject requests and\n    responses containing an invalid empty Content-Length\n    header. The previous behavior may be restored by setting\n    GODEBUG field httplaxcontentlength=1.\n  * net/http: The new method Request.PathValue returns path\n    wildcard values from a request and the new method\n    Request.SetPathValue sets path wildcard values on a request.\n  * net/http/cgi: When executing a CGI process, the PATH_INFO\n    variable is now always set to the empty string or a value\n    starting with a / character, as required by RFC 3875. It was\n    previously possible for some combinations of Handler.Root and\n    request URL to violate this requirement.\n  * net/netip: The new AddrPort.Compare method compares two\n    AddrPorts.\n  * os: On Windows, the Stat function now follows all reparse\n    points that link to another named entity in the system. It was\n    previously only following IO_REPARSE_TAG_SYMLINK and\n    IO_REPARSE_TAG_MOUNT_POINT reparse points.\n  * os: On Windows, passing O_SYNC to OpenFile now causes write\n    operations to go directly to disk, equivalent to O_SYNC on Unix\n    platforms.\n  * os: On Windows, the ReadDir, File.ReadDir, File.Readdir, and\n    File.Readdirnames functions now read directory entries in\n    batches to reduce the number of system calls, improving\n    performance up to 30%.\n  * os: When io.Copy copies from a File to a net.UnixConn, it will\n    now use Linux's sendfile(2) system call if possible, using the\n    new method File.WriteTo.\n  * os/exec: On Windows, LookPath now ignores empty entries\n    in %PATH%, and returns ErrNotFound (instead of ErrNotExist)\n    if no executable file extension is found to resolve an\n    otherwise-unambiguous name.\n  * os/exec: On Windows, Command and Cmd.Start no longer call\n    LookPath if the path to the executable is already absolute and\n    has an executable file extension. In addition, Cmd.Start no\n    longer writes the resolved extension back to the Path field, so\n    it is now safe to call the String method concurrently with a\n    call to Start.\n  * reflect: The Value.IsZero method will now return true for a\n    floating-point or complex negative zero, and will return true\n    for a struct value if a blank field (a field named _) somehow\n    has a non-zero value. These changes make IsZero consistent with\n    comparing a value to zero using the language == operator.\n  * reflect: The PtrTo function is deprecated, in favor of\n    PointerTo.\n  * reflect: The new function TypeFor returns the Type that\n    represents the type argument T. Previously, to get the\n    reflect.Type value for a type, one had to use\n    reflect.TypeOf((*T)(nil)).Elem(). This may now be written as\n    reflect.TypeFor[T]().\n  * runtime/metrics: Four new histogram metrics\n    /sched/pauses/stopping/gc:seconds,\n    /sched/pauses/stopping/other:seconds,\n    /sched/pauses/total/gc:seconds, and\n    /sched/pauses/total/other:seconds provide additional details\n    about stop-the-world pauses. The 'stopping' metrics report the\n    time taken from deciding to stop the world until all goroutines\n    are stopped. The 'total' metrics report the time taken from\n    deciding to stop the world until it is started again.\n  * runtime/metrics: The /gc/pauses:seconds metric is deprecated,\n    as it is equivalent to the new /sched/pauses/total/gc:seconds\n    metric.\n  * runtime/metrics: /sync/mutex/wait/total:seconds now includes\n    contention on runtime-internal locks in addition to sync.Mutex\n    and sync.RWMutex.\n  * runtime/pprof: Mutex profiles now scale contention by the\n    number of goroutines blocked on the mutex. This provides a more\n    accurate representation of the degree to which a mutex is a\n    bottleneck in a Go program. For instance, if 100 goroutines are\n    blocked on a mutex for 10 milliseconds, a mutex profile will\n    now record 1 second of delay instead of 10 milliseconds of\n    delay.\n  * runtime/pprof: Mutex profiles also now include contention on\n    runtime-internal locks in addition to sync.Mutex and\n    sync.RWMutex. Contention on runtime-internal locks is always\n    reported at runtime._LostContendedRuntimeLock. A future release\n    will add complete stack traces in these cases.\n  * runtime/pprof: CPU profiles on Darwin platforms now contain the\n    process's memory map, enabling the disassembly view in the\n    pprof tool.\n  * runtime/trace: The execution tracer has been completely\n    overhauled in this release, resolving several long-standing\n    issues and paving the way for new use-cases for execution\n    traces.\n  * runtime/trace: Execution traces now use the operating system's\n    clock on most platforms (Windows excluded) so it is possible to\n    correlate them with traces produced by lower-level\n    components. Execution traces no longer depend on the\n    reliability of the platform's clock to produce a correct\n    trace. Execution traces are now partitioned regularly\n    on-the-fly and as a result may be processed in a streamable\n    way. Execution traces now contain complete durations for all\n    system calls. Execution traces now contain information about\n    the operating system threads that goroutines executed on. The\n    latency impact of starting and stopping execution traces has\n    been dramatically reduced. Execution traces may now begin or\n    end during the garbage collection mark phase.\n  * runtime/trace: To allow Go developers to take advantage of\n    these improvements, an experimental trace reading package is\n    available at golang.org/x/exp/trace. Note that this package\n    only works on traces produced by programs built with go1.22 at\n    the moment. Please try out the package and provide feedback on\n    the corresponding proposal issue.\n  * runtime/trace: If you experience any issues with the new\n    execution tracer implementation, you may switch back to the old\n    implementation by building your Go program with\n    GOEXPERIMENT=noexectracer2. If you do, please file an issue,\n    otherwise this option will be removed in a future release.\n  * slices: The new function Concat concatenates multiple slices.\n  * slices: Functions that shrink the size of a slice (Delete,\n    DeleteFunc, Compact, CompactFunc, and Replace) now zero the\n    elements between the new length and the old length.\n  * slices: Insert now always panics if the argument i is out of\n    range. Previously it did not panic in this situation if there\n    were no elements to be inserted.\n  * syscall: The syscall package has been frozen since Go 1.4 and\n    was marked as deprecated in Go 1.11, causing many editors to\n    warn about any use of the package. However, some non-deprecated\n    functionality requires use of the syscall package, such as the\n    os/exec.Cmd.SysProcAttr field. To avoid unnecessary complaints\n    on such code, the syscall package is no longer marked as\n    deprecated. The package remains frozen to most new\n    functionality, and new code remains encouraged to use\n    golang.org/x/sys/unix or golang.org/x/sys/windows where\n    possible.\n  * syscall: On Linux, the new SysProcAttr.PidFD field allows\n    obtaining a PID FD when starting a child process via\n    StartProcess or os/exec.\n  * syscall: On Windows, passing O_SYNC to Open now causes write\n    operations to go directly to disk, equivalent to O_SYNC on Unix\n    platforms.\n  * testing/slogtest: The new Run function uses sub-tests to run\n    test cases, providing finer-grained control.\n  * Ports: Darwin: On macOS on 64-bit x86 architecture (the\n    darwin/amd64 port), the Go toolchain now generates\n    position-independent executables (PIE) by default. Non-PIE\n    binaries can be generated by specifying the -buildmode=exe\n    build flag. On 64-bit ARM-based macOS (the darwin/arm64 port),\n    the Go toolchain already generates PIE by default. go1.22 is\n    the last release that will run on macOS 10.15 Catalina. Go 1.23\n    will require macOS 11 Big Sur or later.\n  * Ports: Arm: The GOARM environment variable now allows you to\n    select whether to use software or hardware floating\n    point. Previously, valid GOARM values were 5, 6, or 7. Now\n    those same values can be optionally followed by ,softfloat or\n    ,hardfloat to select the floating-point implementation. This\n    new option defaults to softfloat for version 5 and hardfloat\n    for versions 6 and 7.\n  * Ports: Loong64: The loong64 port now supports passing function\n    arguments and results using registers. The linux/loong64 port\n    now supports the address sanitizer, memory sanitizer, new-style\n    linker relocations, and the plugin build mode.\n","status":"published","published":"2024-03-19T14:19:08Z","modified":"2026-02-04T04:19:03.681248Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:3089-1","title":"Security update for go1.21-openssl","description":"This update for go1.21-openssl fixes the following issues:\n  \n- CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)\n- CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)\n- CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)\n- CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)\n- CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)\n- CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000) \n- CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)\n- CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)\n- CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)\n- CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)\n\nOther fixes:\n- Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)\n- Update to version 1.21.13 (bsc#1212475)\n- Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)\n- Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)\n","status":"published","published":"2024-09-03T13:52:11Z","modified":"2026-02-04T02:48:37.696584Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:3755-1","title":"Security update for go1.21-openssl","description":"This update for go1.21-openssl fixes the following issues:\n  \n- CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)\n- CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)\n- CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)\n- CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)\n- CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)\n- CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000) \n- CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)\n- CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)\n- CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)\n- CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)\n\nOther fixes:\n- Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)\n- Update to version 1.21.13 (bsc#1212475)\n- Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)\n- Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)\n","status":"published","published":"2024-10-24T07:54:03Z","modified":"2026-02-04T02:15:27.4674Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3772-1","title":"Security update for go1.22-openssl","description":"This update for go1.22-openssl fixes the following issues:\n\nThis update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)\n\n- Update to version 1.22.7.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.7-1-openssl-fips.\n\n  * Update to Go 1.22.7 (#229)\n\n- go1.22.7 (released 2024-09-05) includes security fixes to the\n  encoding/gob, go/build/constraint, and go/parser packages, as\n  well as bug fixes to the fix command and the runtime.\n\n  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:\n  - go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)\n  - go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)\n  - go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)\n  - go#68811 os: TestChtimes failures\n  - go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0\n  - go#68972 cmd/cgo: aix c-archive corrupting stack\n\n- go1.22.6 (released 2024-08-06) includes fixes to the go command,\n  the compiler, the linker, the trace command, the covdata command,\n  and the bytes, go/types, and os/exec packages.\n\n  * go#68594 cmd/compile: internal compiler error with zero-size types\n  * go#68546 cmd/trace/v2: pprof profiles always empty\n  * go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop\n  * go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm\n  * go#68370 go/types: assertion failure in recent range statement checking logic\n  * go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows\n  * go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race\n  * go#68222 cmd/go: list with -export and -covermode=atomic fails to build\n  * go#68198 cmd/link: issues with Xcode 16 beta\n\n- Update to version 1.22.5.3 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.5-3-openssl-fips.\n\n  * Only load openssl if fips == '1'\n    Avoid loading openssl whenever GOLANG_FIPS is not 1.\n    Previously only an unset variable would cause the library load\n    to be skipped, but users may also expect to be able to set eg.\n    GOLANG_FIPS=0 in environments without openssl.\n\n- Update to version 1.22.5.2 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.5-2-openssl-fips.\n\n  * Only load OpenSSL when in FIPS mode\n\n- Update to version 1.22.5.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.5-1-openssl-fips.\n\n  * Update to go1.22.5\n\n- go1.22.5 (released 2024-07-02) includes security fixes to the\n  net/http package, as well as bug fixes to the compiler, cgo, the\n  go command, the linker, the runtime, and the crypto/tls,\n  go/types, net, net/http, and os/exec packages.\n\n  CVE-2024-24791:\n  * go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways\n  * go#65983 cmd/compile: hash of unhashable type\n  * go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()\n  * go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22\n  * go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds\n  * go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders\n  * go#67798 cmd/compile: internal compiler error: unexpected type: \u003cnil\u003e (\u003cnil\u003e) in for-range\n  * go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec\n  * go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0\n  * go#67934 net: go DNS resolver fails to connect to local DNS server\n  * go#67945 cmd/link: using -fuzz with test that links with cgo on darwin causes linker failure\n  * go#68052 cmd/go: go list -u -m all fails loading module retractions: module requires go \u003e= 1.N+1 (running go 1.N)\n  * go#68122 cmd/link: runtime.mach_vm_region_trampoline: unsupported dynamic relocation for symbol libc_mach_task_self_ (type=29 (R_GOTPCREL) stype=46 (SDYNIMPORT))\n\n- Update to version 1.22.4.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.4-1-openssl-fips.\n\n  * Update to go1.22.4\n\n- go1.22.4 (released 2024-06-04) includes security fixes to the\n  archive/zip and net/netip packages, as well as bug fixes to the\n  compiler, the go command, the linker, the runtime, and the os\n  package.\n\n  CVE-2024-24789 CVE-2024-24790:\n  * go#67554 go#66869 bsc#1225973 security: fix CVE-2024-24789 archive/zip: EOCDR comment length handling is inconsistent with other ZIP implementations\n  * go#67682 go#67680 bsc#1225974 security: fix CVE-2024-24790 net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses\n  * go#67188 runtime/metrics: /memory/classes/heap/unused:bytes spikes\n  * go#67212 cmd/compile: SIGBUS unaligned access on mips64 via qemu-mips64\n  * go#67236 cmd/go: mod tidy reports toolchain not available with 'go 1.21'\n  * go#67258 runtime: unexpected fault address 0\n  * go#67311 cmd/go: TestScript/gotoolchain_issue66175 fails on tip locally\n  * go#67314 cmd/go,cmd/link: TestScript/build_issue48319 and TestScript/build_plugin_reproducible failing on LUCI gotip-darwin-amd64-longtest builder due to non-reproducible LC_UUID\n  * go#67352 crypto/x509: TestPlatformVerifier failures on Windows due to broken connections\n  * go#67460 cmd/compile: internal compiler error: panic with range over integer value\n  * go#67527 cmd/link: panic: machorelocsect: size mismatch\n  * go#67650 runtime: SIGSEGV after performing clone(CLONE_PARENT) via C constructor prior to runtime start\n  * go#67696 os: RemoveAll susceptible to symlink race\n\n- Update to version 1.22.3.3 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.3-3-openssl-fips.\n\n  * config: update openssl backend (#201)\n\n- Update to version 1.22.3.2 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.3-2-openssl-fips.\n\n  * patches: restore signature of HashSign/HashVerify (#199)\n\n- Update to version 1.22.3.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.3-1-openssl-fips.\n\n  * Update to go1.22.3\n  * fix: rename patch file\n  * Backport change https://go-review.googlesource.com/c/go/+/554615 to Go1.22 (#193)\n    runtime: crash asap and extend total sleep time for slow machine in test\n    Running with few threads usually does not need 500ms to crash, so let it\n    crash as soon as possible. While the test may caused more time on slow\n    machine, try to expand the sleep time in test.\n  * cmd/go: re-enable CGO for Go toolchain commands (#190)\n  * crypto/ecdsa: Restore HashSign and HashVerify (#189)\n\n- go1.22.3 (released 2024-05-07) includes security fixes to the go\n  command and the net package, as well as bug fixes to the\n  compiler, the runtime, and the net/http package.\n\n  CVE-2024-24787 CVE-2024-24788:\n  * go#67122 go#67119 bsc#1224017 security: fix CVE-2024-24787 cmd/go: arbitrary code execution during build on darwin\n  * go#67040 go#66754 bsc#1224018 security: fix CVE-2024-24788 net: high cpu usage in extractExtendedRCode\n  * go#67018 cmd/compile: Go 1.22.x failed to be bootstrapped from 386 to ppc64le\n  * go#67017 cmd/compile: changing a hot concrete method to interface method triggers a PGO ICE\n  * go#66886 runtime: deterministic fallback hashes across process boundary\n  * go#66698 net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/net@v0.23.0\n\n- Update to version 1.22.2.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.2-1-openssl-fips.\n\n  * Update to go1.22.2\n\n- go1.22.2 (released 2024-04-03) includes a security fix to the\n  net/http package, as well as bug fixes to the compiler, the go\n  command, the linker, and the encoding/gob, go/types, net/http,\n  and runtime/trace packages.\n\n  CVE-2023-45288:\n  * go#66298 go#65051 bsc#1221400 security: fix CVE-2023-45288 net/http, x/net/http2: close connections when receiving too many headers\n  * go#65858 cmd/compile: unreachable panic with GODEBUG=gotypesalias=1\n  * go#66060 cmd/link: RISC-V external link, failed to find text symbol for HI20 relocation\n  * go#66076 cmd/compile: out-of-bounds panic with uint32 conversion and modulus operation in Go 1.22.0 on arm64\n  * go#66134 cmd/compile: go test . results in CLOSURE ... \u003cunknown line number\u003e: internal compiler error: assertion failed\n  * go#66137 cmd/go: go 1.22.0: go test throws errors when processing folders not listed in coverpkg argument\n  * go#66178 cmd/compile: ICE: panic: interface conversion: ir.Node is *ir.ConvExpr, not *ir.IndexExpr\n  * go#66201 runtime/trace: v2 traces contain an incorrect timestamp scaling factor on Windows\n  * go#66255 net/http: http2 round tripper nil pointer dereference causes panic causing deadlock\n  * go#66256 cmd/go: git shallow fetches broken at CL 556358\n  * go#66273 crypto/x509: Certificate no longer encodable using encoding/gob in Go1.22\n  * go#66412 cmd/link: bad carrier sym for symbol runtime.elf_savegpr0.args_stackmap on ppc64le\n\n- Update to version 1.22.1.2 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.1-2-openssl-fips.\n\n  * config: Update openssl v2 module (#178)\n\n- Remove subpackage go1.x-openssl-libstd for compiled shared object\n  libstd.so.\n\n  * Continue to build experimental libstd only on go1.x Tumbleweed.\n  * Removal fixes build errors on go1.x-openssl Factory and ALP.\n  * Use of libstd.so is experimental and not recommended for\n    general use, Go currently has no ABI.\n  * Feature go build -buildmode=shared is deprecated by upstream,\n    but not yet removed.\n\n- Initial package go1.22-openssl version 1.22.1.1 cut from the\n  go1.22-fips-release branch at the revision tagged\n  go1.22.1-1-openssl-fips.\n\n  * Go upstream merged branch dev.boringcrypto in go1.19+.\n  * In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.\n  * In go1.x-openssl enable FIPS mode (or boring mode as the\n    package is named) either via an environment variable\n    GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.\n  * When the operating system is operating in FIPS mode, Go\n    applications which import crypto/tls/fipsonly limit operations\n    to the FIPS ciphersuite.\n  * go1.x-openssl is delivered as two large patches to go1.x\n    applying necessary modifications from the golang-fips/go GitHub\n    project for the Go crypto library to use OpenSSL as the\n    external cryptographic library in a FIPS compliant way.\n  * go1.x-openssl modifies the crypto/* packages to use OpenSSL for\n    cryptographic operations.\n  * go1.x-openssl uses dlopen() to call into OpenSSL.\n  * SUSE RPM packaging introduces a fourth version digit go1.x.y.z\n    corresponding to the golang-fips/go patchset tagged revision.\n  * Patchset improvements can be updated independently of upstream\n    Go maintenance releases.\n\n- go1.22.1 (released 2024-03-05) includes security fixes to the\n  crypto/x509, html/template, net/http, net/http/cookiejar, and\n  net/mail packages, as well as bug fixes to the compiler, the go\n  command, the runtime, the trace command, and the go/types and\n  net/http packages.\n\n  CVE-2023-45289 CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24785:\n  * go#65831 go#65390 bsc#1220999 security: fix CVE-2024-24783 crypto/x509: Verify panics on certificates with an unknown public key algorithm\n  * go#65849 go#65083 bsc#1221002 security: fix CVE-2024-24784 net/mail: comments in display names are incorrectly handled\n  * go#65850 go#65383 bsc#1221001 security: fix CVE-2023-45290 net/http: memory exhaustion in Request.ParseMultipartForm\n  * go#65859 go#65065 bsc#1221000 security: fix CVE-2023-45289 net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect\n  * go#65969 go#65697 bsc#1221003 security: fix CVE-2024-24785 html/template: errors returned from MarshalJSON methods may break template escaping\n  * go#65352 cmd/go: go generate fails silently when run on a package in a nested workspace module\n  * go#65471 internal/testenv: TestHasGoBuild failures on the LUCI noopt builders\n  * go#65474 internal/testenv: support LUCI mobile builders in testenv tests\n  * go#65577 cmd/trace/v2: goroutine analysis page doesn't identify goroutines consistently\n  * go#65618 cmd/compile: Go 1.22 build fails with 1.21 PGO profile on internal/saferio change\n  * go#65619 cmd/compile: Go 1.22 changes support for modules that declare go 1.0\n  * go#65641 cmd/cgo/internal/testsanitizers,x/build: LUCI clang15 builders failing\n  * go#65644 runtime: crash in race detector when execution tracer reads from CPU profile buffer\n  * go#65728 go/types: nil pointer dereference in Alias.Underlying()\n  * go#65759 net/http: context cancellation can leave HTTP client with deadlocked HTTP/1.1 connections in Go1.22\n  * go#65760 runtime: Go 1.22.0 fails to build from source on armv7 Alpine Linux\n  * go#65818 runtime: go1.22.0 test with -race will SIGSEGV or SIGBUS or Bad Pointer\n  * go#65852 cmd/go: 'missing ziphash' error with go.work\n  * go#65883 runtime: scheduler sometimes starves a runnable goroutine on wasm platforms\n\n  * bsc#1219988 ensure VERSION file is present in GOROOT\n    as required by go tool dist and go tool distpack\n\n- go1.22 (released 2024-02-06) is a major release of Go.\n  go1.22.x minor releases will be provided through February 2024.\n  https://github.com/golang/go/wiki/Go-Release-Cycle\n  go1.22 arrives six months after go1.21. Most of its changes are\n  in the implementation of the toolchain, runtime, and libraries.\n  As always, the release maintains the Go 1 promise of\n  compatibility. We expect almost all Go programs to continue to\n  compile and run as before.\n\n  * Language change: go1.22 makes two changes to for loops.\n    Previously, the variables declared by a for loop were created\n    once and updated by each iteration. In go1.22, each iteration\n    of the loop creates new variables, to avoid accidental sharing\n    bugs. The transition support tooling described in the proposal\n    continues to work in the same way it did in Go 1.21.\n  * Language change: For loops may now range over integers\n  * Language change: go1.22 includes a preview of a language change\n    we are considering for a future version of Go:\n    range-over-function iterators. Building with\n    GOEXPERIMENT=rangefunc enables this feature.\n  * go command: Commands in workspaces can now use a vendor\n    directory containing the dependencies of the workspace. The\n    directory is created by go work vendor, and used by build\n    commands when the -mod flag is set to vendor, which is the\n    default when a workspace vendor directory is present.  Note\n    that the vendor directory's contents for a workspace are\n    different from those of a single module: if the directory at\n    the root of a workspace also contains one of the modules in the\n    workspace, its vendor directory can contain the dependencies of\n    either the workspace or of the module, but not both.\n  * go get is no longer supported outside of a module in the legacy\n    GOPATH mode (that is, with GO111MODULE=off). Other build\n    commands, such as go build and go test, will continue to work\n    indefinitely for legacy GOPATH programs.\n  * go mod init no longer attempts to import module requirements\n    from configuration files for other vendoring tools (such as\n    Gopkg.lock).\n  * go test -cover now prints coverage summaries for covered\n    packages that do not have their own test files. Prior to Go\n    1.22 a go test -cover run for such a package would report: ?\n    mymod/mypack [no test files] and now with go1.22, functions in\n    the package are treated as uncovered: mymod/mypack coverage:\n    0.0% of statements Note that if a package contains no\n    executable code at all, we can't report a meaningful coverage\n    percentage; for such packages the go tool will continue to\n    report that there are no test files.\n  * trace: The trace tool's web UI has been gently refreshed as\n    part of the work to support the new tracer, resolving several\n    issues and improving the readability of various sub-pages. The\n    web UI now supports exploring traces in a thread-oriented\n    view. The trace viewer also now displays the full duration of\n    all system calls.  These improvements only apply for viewing\n    traces produced by programs built with go1.22 or newer. A\n    future release will bring some of these improvements to traces\n    produced by older version of Go.\n  * vet: References to loop variables The behavior of the vet tool\n    has changed to match the new semantics (see above) of loop\n    variables in go1.22. When analyzing a file that requires go1.22\n    or newer (due to its go.mod file or a per-file build\n    constraint), vetcode\u003e no longer reports references to loop\n    variables from within a function literal that might outlive the\n    iteration of the loop. In Go 1.22, loop variables are created\n    anew for each iteration, so such references are no longer at\n    risk of using a variable after it has been updated by the loop.\n  * vet: New warnings for missing values after append The vet tool\n    now reports calls to append that pass no values to be appended\n    to the slice, such as slice = append(slice). Such a statement\n    has no effect, and experience has shown that is nearly always a\n    mistake.\n  * vet: New warnings for deferring time.Since The vet tool now\n    reports a non-deferred call to time.Since(t) within a defer\n    statement. This is equivalent to calling time.Now().Sub(t)\n    before the defer statement, not when the deferred function is\n    called. In nearly all cases, the correct code requires\n    deferring the time.Since call.\n  * vet: New warnings for mismatched key-value pairs in log/slog\n    calls The vet tool now reports invalid arguments in calls to\n    functions and methods in the structured logging package,\n    log/slog, that accept alternating key/value pairs. It reports\n    calls where an argument in a key position is neither a string\n    nor a slog.Attr, and where a final key is missing its value.\n  * runtime: The runtime now keeps type-based garbage collection\n    metadata nearer to each heap object, improving the CPU\n    performance (latency or throughput) of Go programs by\n    1-3%. This change also reduces the memory overhead of the\n    majority Go programs by approximately 1% by deduplicating\n    redundant metadata. Some programs may see a smaller improvement\n    because this change adjusts the size class boundaries of the\n    memory allocator, so some objects may be moved up a size class.\n    A consequence of this change is that some objects' addresses\n    that were previously always aligned to a 16 byte (or higher)\n    boundary will now only be aligned to an 8 byte boundary. Some\n    programs that use assembly instructions that require memory\n    addresses to be more than 8-byte aligned and rely on the memory\n    allocator's previous alignment behavior may break, but we\n    expect such programs to be rare. Such programs may be built\n    with GOEXPERIMENT=noallocheaders to revert to the old metadata\n    layout and restore the previous alignment behavior, but package\n    owners should update their assembly code to avoid the alignment\n    assumption, as this workaround will be removed in a future\n    release.\n  * runtime: On the windows/amd64 port, programs linking or loading\n    Go libraries built with -buildmode=c-archive or\n    -buildmode=c-shared can now use the SetUnhandledExceptionFilter\n    Win32 function to catch exceptions not handled by the Go\n    runtime. Note that this was already supported on the\n    windows/386 port.\n  * compiler: Profile-guided Optimization (PGO) builds can now\n    devirtualize a higher proportion of calls than previously\n    possible. Most programs from a representative set of Go\n    programs now see between 2 and 14% improvement from enabling\n    PGO.\n  * compiler: The compiler now interleaves devirtualization and\n    inlining, so interface method calls are better optimized.\n  * compiler: go1.22 also includes a preview of an enhanced\n    implementation of the compiler's inlining phase that uses\n    heuristics to boost inlinability at call sites deemed\n    'important' (for example, in loops) and discourage inlining at\n    call sites deemed 'unimportant' (for example, on panic\n    paths). Building with GOEXPERIMENT=newinliner enables the new\n    call-site heuristics; see issue #61502 for more info and to\n    provide feedback.\n  * linker: The linker's -s and -w flags are now behave more\n    consistently across all platforms. The -w flag suppresses DWARF\n    debug information generation. The -s flag suppresses symbol\n    table generation. The -s flag also implies the -w flag, which\n    can be negated with -w=0. That is, -s -w=0 will generate a\n    binary with DWARF debug information generation but without the\n    symbol table.\n  * linker: On ELF platforms, the -B linker flag now accepts a\n    special form: with -B gobuildid, the linker will generate a GNU\n    build ID (the ELF NT_GNU_BUILD_ID note) derived from the Go\n    build ID.\n  * linker: On Windows, when building with -linkmode=internal, the\n    linker now preserves SEH information from C object files by\n    copying the .pdata and .xdata sections into the final\n    binary. This helps with debugging and profiling binaries using\n    native tools, such as WinDbg. Note that until now, C functions'\n    SEH exception handlers were not being honored, so this change\n    may cause some programs to behave differently.\n    -linkmode=external is not affected by this change, as external\n    linkers already preserve SEH information.\n  * bootstrap: As mentioned in the Go 1.20 release notes, go1.22\n    now requires the final point release of Go 1.20 or later for\n    bootstrap. We expect that Go 1.24 will require the final point\n    release of go1.22 or later for bootstrap.\n  * core library: New math/rand/v2 package: go1.22 includes the\n    first “v2” package in the standard library, math/rand/v2. The\n    changes compared to math/rand are detailed in proposal\n    go#61716. The most important changes are:\n    - The Read method, deprecated in math/rand, was not carried\n      forward for math/rand/v2. (It remains available in\n      math/rand.) The vast majority of calls to Read should use\n      crypto/rand’s Read instead. Otherwise a custom Read can be\n      constructed using the Uint64 method.\n    - The global generator accessed by top-level functions is\n      unconditionally randomly seeded. Because the API guarantees\n      no fixed sequence of results, optimizations like per-thread\n      random generator states are now possible.\n    - The Source interface now has a single Uint64 method; there is\n      no Source64 interface.\n    - Many methods now use faster algorithms that were not possible\n      to adopt in math/rand because they changed the output\n      streams.\n    - The Intn, Int31, Int31n, Int63, and Int64n top-level\n      functions and methods from math/rand are spelled more\n      idiomatically in math/rand/v2: IntN, Int32, Int32N, Int64,\n      and Int64N. There are also new top-level functions and\n      methods Uint32, Uint32N, Uint64, Uint64N, Uint, and UintN.\n    - The new generic function N is like Int64N or Uint64N but\n      works for any integer type. For example a random duration\n      from 0 up to 5 minutes is rand.N(5*time.Minute).\n    - The Mitchell \u0026 Reeds LFSR generator provided by math/rand’s\n      Source has been replaced by two more modern pseudo-random\n      generator sources: ChaCha8 PCG. ChaCha8 is a new,\n      cryptographically strong random number generator roughly\n      similar to PCG in efficiency. ChaCha8 is the algorithm used\n      for the top-level functions in math/rand/v2. As of go1.22,\n      math/rand's top-level functions (when not explicitly seeded)\n      and the Go runtime also use ChaCha8 for randomness.\n    - We plan to include an API migration tool in a future release,\n      likely Go 1.23.\n  * core library: New go/version package: The new go/version\n    package implements functions for validating and comparing Go\n    version strings.\n  * core library: Enhanced routing patterns: HTTP routing in the\n    standard library is now more expressive. The patterns used by\n    net/http.ServeMux have been enhanced to accept methods and\n    wildcards. This change breaks backwards compatibility in small\n    ways, some obvious—patterns with '{' and '}' behave\n    differently— and some less so—treatment of escaped paths has\n    been improved. The change is controlled by a GODEBUG field\n    named httpmuxgo121. Set httpmuxgo121=1 to restore the old\n    behavior.\n  * Minor changes to the library As always, there are various minor\n    changes and updates to the library, made with the Go 1 promise\n    of compatibility in mind. There are also various performance\n    improvements, not enumerated here.\n  * archive/tar: The new method Writer.AddFS adds all of the files\n    from an fs.FS to the archive.\n  * archive/zip: The new method Writer.AddFS adds all of the files\n    from an fs.FS to the archive.\n  * bufio: When a SplitFunc returns ErrFinalToken with a nil token,\n    Scanner will now stop immediately. Previously, it would report\n    a final empty token before stopping, which was usually not\n    desired. Callers that do want to report a final empty token can\n    do so by returning []byte{} rather than nil.\n  * cmp: The new function Or returns the first in a sequence of\n    values that is not the zero value.\n  * crypto/tls: ConnectionState.ExportKeyingMaterial will now\n    return an error unless TLS 1.3 is in use, or the\n    extended_master_secret extension is supported by both the\n    server and client. crypto/tls has supported this extension\n    since Go 1.20. This can be disabled with the tlsunsafeekm=1\n    GODEBUG setting.\n  * crypto/tls: By default, the minimum version offered by\n    crypto/tls servers is now TLS 1.2 if not specified with\n    config.MinimumVersion, matching the behavior of crypto/tls\n    clients. This change can be reverted with the tls10server=1\n    GODEBUG setting.\n  * crypto/tls: By default, cipher suites without ECDHE support are\n    no longer offered by either clients or servers during pre-TLS\n    1.3 handshakes. This change can be reverted with the\n    tlsrsakex=1 GODEBUG setting.\n  * crypto/x509: The new CertPool.AddCertWithConstraint method can\n    be used to add customized constraints to root certificates to\n    be applied during chain building.\n  * crypto/x509: On Android, root certificates will now be loaded\n    from /data/misc/keychain/certs-added as well as\n    /system/etc/security/cacerts.\n  * crypto/x509: A new type, OID, supports ASN.1 Object Identifiers\n    with individual components larger than 31 bits. A new field\n    which uses this type, Policies, is added to the Certificate\n    struct, and is now populated during parsing. Any OIDs which\n    cannot be represented using a asn1.ObjectIdentifier will appear\n    in Policies, but not in the old PolicyIdentifiers field. When\n    calling CreateCertificate, the Policies field is ignored, and\n    policies are taken from the PolicyIdentifiers field. Using the\n    x509usepolicies=1 GODEBUG setting inverts this, populating\n    certificate policies from the Policies field, and ignoring the\n    PolicyIdentifiers field. We may change the default value of\n    x509usepolicies in Go 1.23, making Policies the default field\n    for marshaling.\n  * database/sql: The new Null[T] type provide a way to scan\n    nullable columns for any column types.\n  * debug/elf: Constant R_MIPS_PC32 is defined for use with MIPS64\n    systems. Additional R_LARCH_* constants are defined for use\n    with LoongArch systems.\n  * encoding: The new methods AppendEncode and AppendDecode added\n    to each of the Encoding types in the packages encoding/base32,\n    encoding/base64, and encoding/hex simplify encoding and\n    decoding from and to byte slices by taking care of byte slice\n    buffer management.\n  * encoding: The methods base32.Encoding.WithPadding and\n    base64.Encoding.WithPadding now panic if the padding argument\n    is a negative value other than NoPadding.\n  * encoding/json: Marshaling and encoding functionality now\n    escapes '\\b' and '\\f' characters as \\b and \\f instead of \\u0008\n    and \\u000c.\n  * go/ast: The following declarations related to syntactic\n    identifier resolution are now deprecated: Ident.Obj, Object,\n    Scope, File.Scope, File.Unresolved, Importer, Package,\n    NewPackage. In general, identifiers cannot be accurately\n    resolved without type information. Consider, for example, the\n    identifier K in T{K: ''}: it could be the name of a local\n    variable if T is a map type, or the name of a field if T is a\n    struct type. New programs should use the go/types package to\n    resolve identifiers; see Object, Info.Uses, and Info.Defs for\n    details.\n  * go/ast: The new ast.Unparen function removes any enclosing\n    parentheses from an expression.\n  * go/types: The new Alias type represents type\n    aliases. Previously, type aliases were not represented\n    explicitly, so a reference to a type alias was equivalent to\n    spelling out the aliased type, and the name of the alias was\n    lost. The new representation retains the intermediate\n    Alias. This enables improved error reporting (the name of a\n    type alias can be reported), and allows for better handling of\n    cyclic type declarations involving type aliases. In a future\n    release, Alias types will also carry type parameter\n    information. The new function Unalias returns the actual type\n    denoted by an Alias type (or any other Type for that matter).\n  * go/types: Because Alias types may break existing type switches\n    that do not know to check for them, this functionality is\n    controlled by a GODEBUG field named gotypesalias. With\n    gotypesalias=0, everything behaves as before, and Alias types\n    are never created. With gotypesalias=1, Alias types are created\n    and clients must expect them. The default is gotypesalias=0. In\n    a future release, the default will be changed to\n    gotypesalias=1. Clients of go/types are urged to adjust their\n    code as soon as possible to work with gotypesalias=1 to\n    eliminate problems early.\n  * go/types: The Info struct now exports the FileVersions map\n    which provides per-file Go version information.\n  * go/types: The new helper method PkgNameOf returns the local\n    package name for the given import declaration.\n  * go/types: The implementation of SizesFor has been adjusted to\n    compute the same type sizes as the compiler when the compiler\n    argument for SizesFor is 'gc'. The default Sizes implementation\n    used by the type checker is now types.SizesFor('gc', 'amd64').\n  * go/types: The start position (Pos) of the lexical environment\n    block (Scope) that represents a function body has changed: it\n    used to start at the opening curly brace of the function body,\n    but now starts at the function's func token.\n  * html/template: Javascript template literals may now contain Go\n    template actions, and parsing a template containing one will no\n    longer return ErrJSTemplate. Similarly the GODEBUG setting\n    jstmpllitinterp no longer has any effect.\n  * io: The new SectionReader.Outer method returns the ReaderAt,\n    offset, and size passed to NewSectionReader.\n  * log/slog: The new SetLogLoggerLevel function controls the level\n    for the bridge between the `slog` and `log` packages. It sets\n    the minimum level for calls to the top-level `slog` logging\n    functions, and it sets the level for calls to `log.Logger` that\n    go through `slog`.\n  * math/big: The new method Rat.FloatPrec computes the number of\n    fractional decimal digits required to represent a rational\n    number accurately as a floating-point number, and whether\n    accurate decimal representation is possible in the first place.\n  * net: When io.Copy copies from a TCPConn to a UnixConn, it will\n    now use Linux's splice(2) system call if possible, using the\n    new method TCPConn.WriteTo.\n  * net: The Go DNS Resolver, used when building with\n    '-tags=netgo', now searches for a matching name in the Windows\n    hosts file, located at %SystemRoot%\\System32\\drivers\\etc\\hosts,\n    before making a DNS query.\n  * net/http: The new functions ServeFileFS, FileServerFS, and\n    NewFileTransportFS are versions of the existing ServeFile,\n    FileServer, and NewFileTransport, operating on an fs.FS.\n  * net/http: The HTTP server and client now reject requests and\n    responses containing an invalid empty Content-Length\n    header. The previous behavior may be restored by setting\n    GODEBUG field httplaxcontentlength=1.\n  * net/http: The new method Request.PathValue returns path\n    wildcard values from a request and the new method\n    Request.SetPathValue sets path wildcard values on a request.\n  * net/http/cgi: When executing a CGI process, the PATH_INFO\n    variable is now always set to the empty string or a value\n    starting with a / character, as required by RFC 3875. It was\n    previously possible for some combinations of Handler.Root and\n    request URL to violate this requirement.\n  * net/netip: The new AddrPort.Compare method compares two\n    AddrPorts.\n  * os: On Windows, the Stat function now follows all reparse\n    points that link to another named entity in the system. It was\n    previously only following IO_REPARSE_TAG_SYMLINK and\n    IO_REPARSE_TAG_MOUNT_POINT reparse points.\n  * os: On Windows, passing O_SYNC to OpenFile now causes write\n    operations to go directly to disk, equivalent to O_SYNC on Unix\n    platforms.\n  * os: On Windows, the ReadDir, File.ReadDir, File.Readdir, and\n    File.Readdirnames functions now read directory entries in\n    batches to reduce the number of system calls, improving\n    performance up to 30%.\n  * os: When io.Copy copies from a File to a net.UnixConn, it will\n    now use Linux's sendfile(2) system call if possible, using the\n    new method File.WriteTo.\n  * os/exec: On Windows, LookPath now ignores empty entries\n    in %PATH%, and returns ErrNotFound (instead of ErrNotExist)\n    if no executable file extension is found to resolve an\n    otherwise-unambiguous name.\n  * os/exec: On Windows, Command and Cmd.Start no longer call\n    LookPath if the path to the executable is already absolute and\n    has an executable file extension. In addition, Cmd.Start no\n    longer writes the resolved extension back to the Path field, so\n    it is now safe to call the String method concurrently with a\n    call to Start.\n  * reflect: The Value.IsZero method will now return true for a\n    floating-point or complex negative zero, and will return true\n    for a struct value if a blank field (a field named _) somehow\n    has a non-zero value. These changes make IsZero consistent with\n    comparing a value to zero using the language == operator.\n  * reflect: The PtrTo function is deprecated, in favor of\n    PointerTo.\n  * reflect: The new function TypeFor returns the Type that\n    represents the type argument T. Previously, to get the\n    reflect.Type value for a type, one had to use\n    reflect.TypeOf((*T)(nil)).Elem(). This may now be written as\n    reflect.TypeFor[T]().\n  * runtime/metrics: Four new histogram metrics\n    /sched/pauses/stopping/gc:seconds,\n    /sched/pauses/stopping/other:seconds,\n    /sched/pauses/total/gc:seconds, and\n    /sched/pauses/total/other:seconds provide additional details\n    about stop-the-world pauses. The 'stopping' metrics report the\n    time taken from deciding to stop the world until all goroutines\n    are stopped. The 'total' metrics report the time taken from\n    deciding to stop the world until it is started again.\n  * runtime/metrics: The /gc/pauses:seconds metric is deprecated,\n    as it is equivalent to the new /sched/pauses/total/gc:seconds\n    metric.\n  * runtime/metrics: /sync/mutex/wait/total:seconds now includes\n    contention on runtime-internal locks in addition to sync.Mutex\n    and sync.RWMutex.\n  * runtime/pprof: Mutex profiles now scale contention by the\n    number of goroutines blocked on the mutex. This provides a more\n    accurate representation of the degree to which a mutex is a\n    bottleneck in a Go program. For instance, if 100 goroutines are\n    blocked on a mutex for 10 milliseconds, a mutex profile will\n    now record 1 second of delay instead of 10 milliseconds of\n    delay.\n  * runtime/pprof: Mutex profiles also now include contention on\n    runtime-internal locks in addition to sync.Mutex and\n    sync.RWMutex. Contention on runtime-internal locks is always\n    reported at runtime._LostContendedRuntimeLock. A future release\n    will add complete stack traces in these cases.\n  * runtime/pprof: CPU profiles on Darwin platforms now contain the\n    process's memory map, enabling the disassembly view in the\n    pprof tool.\n  * runtime/trace: The execution tracer has been completely\n    overhauled in this release, resolving several long-standing\n    issues and paving the way for new use-cases for execution\n    traces.\n  * runtime/trace: Execution traces now use the operating system's\n    clock on most platforms (Windows excluded) so it is possible to\n    correlate them with traces produced by lower-level\n    components. Execution traces no longer depend on the\n    reliability of the platform's clock to produce a correct\n    trace. Execution traces are now partitioned regularly\n    on-the-fly and as a result may be processed in a streamable\n    way. Execution traces now contain complete durations for all\n    system calls. Execution traces now contain information about\n    the operating system threads that goroutines executed on. The\n    latency impact of starting and stopping execution traces has\n    been dramatically reduced. Execution traces may now begin or\n    end during the garbage collection mark phase.\n  * runtime/trace: To allow Go developers to take advantage of\n    these improvements, an experimental trace reading package is\n    available at golang.org/x/exp/trace. Note that this package\n    only works on traces produced by programs built with go1.22 at\n    the moment. Please try out the package and provide feedback on\n    the corresponding proposal issue.\n  * runtime/trace: If you experience any issues with the new\n    execution tracer implementation, you may switch back to the old\n    implementation by building your Go program with\n    GOEXPERIMENT=noexectracer2. If you do, please file an issue,\n    otherwise this option will be removed in a future release.\n  * slices: The new function Concat concatenates multiple slices.\n  * slices: Functions that shrink the size of a slice (Delete,\n    DeleteFunc, Compact, CompactFunc, and Replace) now zero the\n    elements between the new length and the old length.\n  * slices: Insert now always panics if the argument i is out of\n    range. Previously it did not panic in this situation if there\n    were no elements to be inserted.\n  * syscall: The syscall package has been frozen since Go 1.4 and\n    was marked as deprecated in Go 1.11, causing many editors to\n    warn about any use of the package. However, some non-deprecated\n    functionality requires use of the syscall package, such as the\n    os/exec.Cmd.SysProcAttr field. To avoid unnecessary complaints\n    on such code, the syscall package is no longer marked as\n    deprecated. The package remains frozen to most new\n    functionality, and new code remains encouraged to use\n    golang.org/x/sys/unix or golang.org/x/sys/windows where\n    possible.\n  * syscall: On Linux, the new SysProcAttr.PidFD field allows\n    obtaining a PID FD when starting a child process via\n    StartProcess or os/exec.\n  * syscall: On Windows, passing O_SYNC to Open now causes write\n    operations to go directly to disk, equivalent to O_SYNC on Unix\n    platforms.\n  * testing/slogtest: The new Run function uses sub-tests to run\n    test cases, providing finer-grained control.\n  * Ports: Darwin: On macOS on 64-bit x86 architecture (the\n    darwin/amd64 port), the Go toolchain now generates\n    position-independent executables (PIE) by default. Non-PIE\n    binaries can be generated by specifying the -buildmode=exe\n    build flag. On 64-bit ARM-based macOS (the darwin/arm64 port),\n    the Go toolchain already generates PIE by default. go1.22 is\n    the last release that will run on macOS 10.15 Catalina. Go 1.23\n    will require macOS 11 Big Sur or later.\n  * Ports: Arm: The GOARM environment variable now allows you to\n    select whether to use software or hardware floating\n    point. Previously, valid GOARM values were 5, 6, or 7. Now\n    those same values can be optionally followed by ,softfloat or\n    ,hardfloat to select the floating-point implementation. This\n    new option defaults to softfloat for version 5 and hardfloat\n    for versions 6 and 7.\n  * Ports: Loong64: The loong64 port now supports passing function\n    arguments and results using registers. The linux/loong64 port\n    now supports the address sanitizer, memory sanitizer, new-style\n    linker relocations, and the plugin build mode.\n  * OpenBSD go1.22 adds an experimental port to OpenBSD on\n    big-endian 64-bit PowerPC (openbsd/ppc64).\n","status":"published","published":"2024-10-29T13:54:03Z","modified":"2026-02-04T02:18:09.068514Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3938-1","title":"Security update for go1.22-openssl","description":"This update for go1.22-openssl fixes the following issues:\n\nThis update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)\n\n- Update to version 1.22.7.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.7-1-openssl-fips.\n\n  * Update to Go 1.22.7 (#229)\n\n- go1.22.7 (released 2024-09-05) includes security fixes to the\n  encoding/gob, go/build/constraint, and go/parser packages, as\n  well as bug fixes to the fix command and the runtime.\n\n  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:\n  - go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)\n  - go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)\n  - go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)\n  - go#68811 os: TestChtimes failures\n  - go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0\n  - go#68972 cmd/cgo: aix c-archive corrupting stack\n\n- go1.22.6 (released 2024-08-06) includes fixes to the go command,\n  the compiler, the linker, the trace command, the covdata command,\n  and the bytes, go/types, and os/exec packages.\n\n  * go#68594 cmd/compile: internal compiler error with zero-size types\n  * go#68546 cmd/trace/v2: pprof profiles always empty\n  * go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop\n  * go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm\n  * go#68370 go/types: assertion failure in recent range statement checking logic\n  * go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows\n  * go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race\n  * go#68222 cmd/go: list with -export and -covermode=atomic fails to build\n  * go#68198 cmd/link: issues with Xcode 16 beta\n\n- Update to version 1.22.5.3 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.5-3-openssl-fips.\n\n  * Only load openssl if fips == '1'\n    Avoid loading openssl whenever GOLANG_FIPS is not 1.\n    Previously only an unset variable would cause the library load\n    to be skipped, but users may also expect to be able to set eg.\n    GOLANG_FIPS=0 in environments without openssl.\n\n- Update to version 1.22.5.2 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.5-2-openssl-fips.\n\n  * Only load OpenSSL when in FIPS mode\n\n- Update to version 1.22.5.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.5-1-openssl-fips.\n\n  * Update to go1.22.5\n\n- go1.22.5 (released 2024-07-02) includes security fixes to the\n  net/http package, as well as bug fixes to the compiler, cgo, the\n  go command, the linker, the runtime, and the crypto/tls,\n  go/types, net, net/http, and os/exec packages.\n\n  CVE-2024-24791:\n  * go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways\n  * go#65983 cmd/compile: hash of unhashable type\n  * go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()\n  * go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22\n  * go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds\n  * go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders\n  * go#67798 cmd/compile: internal compiler error: unexpected type: \u003cnil\u003e (\u003cnil\u003e) in for-range\n  * go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec\n  * go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0\n  * go#67934 net: go DNS resolver fails to connect to local DNS server\n  * go#67945 cmd/link: using -fuzz with test that links with cgo on darwin causes linker failure\n  * go#68052 cmd/go: go list -u -m all fails loading module retractions: module requires go \u003e= 1.N+1 (running go 1.N)\n  * go#68122 cmd/link: runtime.mach_vm_region_trampoline: unsupported dynamic relocation for symbol libc_mach_task_self_ (type=29 (R_GOTPCREL) stype=46 (SDYNIMPORT))\n\n- Update to version 1.22.4.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.4-1-openssl-fips.\n\n  * Update to go1.22.4\n\n- go1.22.4 (released 2024-06-04) includes security fixes to the\n  archive/zip and net/netip packages, as well as bug fixes to the\n  compiler, the go command, the linker, the runtime, and the os\n  package.\n\n  CVE-2024-24789 CVE-2024-24790:\n  * go#67554 go#66869 bsc#1225973 security: fix CVE-2024-24789 archive/zip: EOCDR comment length handling is inconsistent with other ZIP implementations\n  * go#67682 go#67680 bsc#1225974 security: fix CVE-2024-24790 net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses\n  * go#67188 runtime/metrics: /memory/classes/heap/unused:bytes spikes\n  * go#67212 cmd/compile: SIGBUS unaligned access on mips64 via qemu-mips64\n  * go#67236 cmd/go: mod tidy reports toolchain not available with 'go 1.21'\n  * go#67258 runtime: unexpected fault address 0\n  * go#67311 cmd/go: TestScript/gotoolchain_issue66175 fails on tip locally\n  * go#67314 cmd/go,cmd/link: TestScript/build_issue48319 and TestScript/build_plugin_reproducible failing on LUCI gotip-darwin-amd64-longtest builder due to non-reproducible LC_UUID\n  * go#67352 crypto/x509: TestPlatformVerifier failures on Windows due to broken connections\n  * go#67460 cmd/compile: internal compiler error: panic with range over integer value\n  * go#67527 cmd/link: panic: machorelocsect: size mismatch\n  * go#67650 runtime: SIGSEGV after performing clone(CLONE_PARENT) via C constructor prior to runtime start\n  * go#67696 os: RemoveAll susceptible to symlink race\n\n- Update to version 1.22.3.3 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.3-3-openssl-fips.\n\n  * config: update openssl backend (#201)\n\n- Update to version 1.22.3.2 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.3-2-openssl-fips.\n\n  * patches: restore signature of HashSign/HashVerify (#199)\n\n- Update to version 1.22.3.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.3-1-openssl-fips.\n\n  * Update to go1.22.3\n  * fix: rename patch file\n  * Backport change https://go-review.googlesource.com/c/go/+/554615 to Go1.22 (#193)\n    runtime: crash asap and extend total sleep time for slow machine in test\n    Running with few threads usually does not need 500ms to crash, so let it\n    crash as soon as possible. While the test may caused more time on slow\n    machine, try to expand the sleep time in test.\n  * cmd/go: re-enable CGO for Go toolchain commands (#190)\n  * crypto/ecdsa: Restore HashSign and HashVerify (#189)\n\n- go1.22.3 (released 2024-05-07) includes security fixes to the go\n  command and the net package, as well as bug fixes to the\n  compiler, the runtime, and the net/http package.\n\n  CVE-2024-24787 CVE-2024-24788:\n  * go#67122 go#67119 bsc#1224017 security: fix CVE-2024-24787 cmd/go: arbitrary code execution during build on darwin\n  * go#67040 go#66754 bsc#1224018 security: fix CVE-2024-24788 net: high cpu usage in extractExtendedRCode\n  * go#67018 cmd/compile: Go 1.22.x failed to be bootstrapped from 386 to ppc64le\n  * go#67017 cmd/compile: changing a hot concrete method to interface method triggers a PGO ICE\n  * go#66886 runtime: deterministic fallback hashes across process boundary\n  * go#66698 net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/net@v0.23.0\n\n- Update to version 1.22.2.1 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.2-1-openssl-fips.\n\n  * Update to go1.22.2\n\n- go1.22.2 (released 2024-04-03) includes a security fix to the\n  net/http package, as well as bug fixes to the compiler, the go\n  command, the linker, and the encoding/gob, go/types, net/http,\n  and runtime/trace packages.\n\n  CVE-2023-45288:\n  * go#66298 go#65051 bsc#1221400 security: fix CVE-2023-45288 net/http, x/net/http2: close connections when receiving too many headers\n  * go#65858 cmd/compile: unreachable panic with GODEBUG=gotypesalias=1\n  * go#66060 cmd/link: RISC-V external link, failed to find text symbol for HI20 relocation\n  * go#66076 cmd/compile: out-of-bounds panic with uint32 conversion and modulus operation in Go 1.22.0 on arm64\n  * go#66134 cmd/compile: go test . results in CLOSURE ... \u003cunknown line number\u003e: internal compiler error: assertion failed\n  * go#66137 cmd/go: go 1.22.0: go test throws errors when processing folders not listed in coverpkg argument\n  * go#66178 cmd/compile: ICE: panic: interface conversion: ir.Node is *ir.ConvExpr, not *ir.IndexExpr\n  * go#66201 runtime/trace: v2 traces contain an incorrect timestamp scaling factor on Windows\n  * go#66255 net/http: http2 round tripper nil pointer dereference causes panic causing deadlock\n  * go#66256 cmd/go: git shallow fetches broken at CL 556358\n  * go#66273 crypto/x509: Certificate no longer encodable using encoding/gob in Go1.22\n  * go#66412 cmd/link: bad carrier sym for symbol runtime.elf_savegpr0.args_stackmap on ppc64le\n\n- Update to version 1.22.1.2 cut from the go1.22-fips-release\n  branch at the revision tagged go1.22.1-2-openssl-fips.\n\n  * config: Update openssl v2 module (#178)\n\n- Remove subpackage go1.x-openssl-libstd for compiled shared object\n  libstd.so.\n\n  * Continue to build experimental libstd only on go1.x Tumbleweed.\n  * Removal fixes build errors on go1.x-openssl Factory and ALP.\n  * Use of libstd.so is experimental and not recommended for\n    general use, Go currently has no ABI.\n  * Feature go build -buildmode=shared is deprecated by upstream,\n    but not yet removed.\n\n- Initial package go1.22-openssl version 1.22.1.1 cut from the\n  go1.22-fips-release branch at the revision tagged\n  go1.22.1-1-openssl-fips.\n\n  * Go upstream merged branch dev.boringcrypto in go1.19+.\n  * In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.\n  * In go1.x-openssl enable FIPS mode (or boring mode as the\n    package is named) either via an environment variable\n    GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.\n  * When the operating system is operating in FIPS mode, Go\n    applications which import crypto/tls/fipsonly limit operations\n    to the FIPS ciphersuite.\n  * go1.x-openssl is delivered as two large patches to go1.x\n    applying necessary modifications from the golang-fips/go GitHub\n    project for the Go crypto library to use OpenSSL as the\n    external cryptographic library in a FIPS compliant way.\n  * go1.x-openssl modifies the crypto/* packages to use OpenSSL for\n    cryptographic operations.\n  * go1.x-openssl uses dlopen() to call into OpenSSL.\n  * SUSE RPM packaging introduces a fourth version digit go1.x.y.z\n    corresponding to the golang-fips/go patchset tagged revision.\n  * Patchset improvements can be updated independently of upstream\n    Go maintenance releases.\n\n- go1.22.1 (released 2024-03-05) includes security fixes to the\n  crypto/x509, html/template, net/http, net/http/cookiejar, and\n  net/mail packages, as well as bug fixes to the compiler, the go\n  command, the runtime, the trace command, and the go/types and\n  net/http packages.\n\n  CVE-2023-45289 CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24785:\n  * go#65831 go#65390 bsc#1220999 security: fix CVE-2024-24783 crypto/x509: Verify panics on certificates with an unknown public key algorithm\n  * go#65849 go#65083 bsc#1221002 security: fix CVE-2024-24784 net/mail: comments in display names are incorrectly handled\n  * go#65850 go#65383 bsc#1221001 security: fix CVE-2023-45290 net/http: memory exhaustion in Request.ParseMultipartForm\n  * go#65859 go#65065 bsc#1221000 security: fix CVE-2023-45289 net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect\n  * go#65969 go#65697 bsc#1221003 security: fix CVE-2024-24785 html/template: errors returned from MarshalJSON methods may break template escaping\n  * go#65352 cmd/go: go generate fails silently when run on a package in a nested workspace module\n  * go#65471 internal/testenv: TestHasGoBuild failures on the LUCI noopt builders\n  * go#65474 internal/testenv: support LUCI mobile builders in testenv tests\n  * go#65577 cmd/trace/v2: goroutine analysis page doesn't identify goroutines consistently\n  * go#65618 cmd/compile: Go 1.22 build fails with 1.21 PGO profile on internal/saferio change\n  * go#65619 cmd/compile: Go 1.22 changes support for modules that declare go 1.0\n  * go#65641 cmd/cgo/internal/testsanitizers,x/build: LUCI clang15 builders failing\n  * go#65644 runtime: crash in race detector when execution tracer reads from CPU profile buffer\n  * go#65728 go/types: nil pointer dereference in Alias.Underlying()\n  * go#65759 net/http: context cancellation can leave HTTP client with deadlocked HTTP/1.1 connections in Go1.22\n  * go#65760 runtime: Go 1.22.0 fails to build from source on armv7 Alpine Linux\n  * go#65818 runtime: go1.22.0 test with -race will SIGSEGV or SIGBUS or Bad Pointer\n  * go#65852 cmd/go: 'missing ziphash' error with go.work\n  * go#65883 runtime: scheduler sometimes starves a runnable goroutine on wasm platforms\n\n  * bsc#1219988 ensure VERSION file is present in GOROOT\n    as required by go tool dist and go tool distpack\n\n- go1.22 (released 2024-02-06) is a major release of Go.\n  go1.22.x minor releases will be provided through February 2024.\n  https://github.com/golang/go/wiki/Go-Release-Cycle\n  go1.22 arrives six months after go1.21. Most of its changes are\n  in the implementation of the toolchain, runtime, and libraries.\n  As always, the release maintains the Go 1 promise of\n  compatibility. We expect almost all Go programs to continue to\n  compile and run as before.\n\n  * Language change: go1.22 makes two changes to for loops.\n    Previously, the variables declared by a for loop were created\n    once and updated by each iteration. In go1.22, each iteration\n    of the loop creates new variables, to avoid accidental sharing\n    bugs. The transition support tooling described in the proposal\n    continues to work in the same way it did in Go 1.21.\n  * Language change: For loops may now range over integers\n  * Language change: go1.22 includes a preview of a language change\n    we are considering for a future version of Go:\n    range-over-function iterators. Building with\n    GOEXPERIMENT=rangefunc enables this feature.\n  * go command: Commands in workspaces can now use a vendor\n    directory containing the dependencies of the workspace. The\n    directory is created by go work vendor, and used by build\n    commands when the -mod flag is set to vendor, which is the\n    default when a workspace vendor directory is present.  Note\n    that the vendor directory's contents for a workspace are\n    different from those of a single module: if the directory at\n    the root of a workspace also contains one of the modules in the\n    workspace, its vendor directory can contain the dependencies of\n    either the workspace or of the module, but not both.\n  * go get is no longer supported outside of a module in the legacy\n    GOPATH mode (that is, with GO111MODULE=off). Other build\n    commands, such as go build and go test, will continue to work\n    indefinitely for legacy GOPATH programs.\n  * go mod init no longer attempts to import module requirements\n    from configuration files for other vendoring tools (such as\n    Gopkg.lock).\n  * go test -cover now prints coverage summaries for covered\n    packages that do not have their own test files. Prior to Go\n    1.22 a go test -cover run for such a package would report: ?\n    mymod/mypack [no test files] and now with go1.22, functions in\n    the package are treated as uncovered: mymod/mypack coverage:\n    0.0% of statements Note that if a package contains no\n    executable code at all, we can't report a meaningful coverage\n    percentage; for such packages the go tool will continue to\n    report that there are no test files.\n  * trace: The trace tool's web UI has been gently refreshed as\n    part of the work to support the new tracer, resolving several\n    issues and improving the readability of various sub-pages. The\n    web UI now supports exploring traces in a thread-oriented\n    view. The trace viewer also now displays the full duration of\n    all system calls.  These improvements only apply for viewing\n    traces produced by programs built with go1.22 or newer. A\n    future release will bring some of these improvements to traces\n    produced by older version of Go.\n  * vet: References to loop variables The behavior of the vet tool\n    has changed to match the new semantics (see above) of loop\n    variables in go1.22. When analyzing a file that requires go1.22\n    or newer (due to its go.mod file or a per-file build\n    constraint), vetcode\u003e no longer reports references to loop\n    variables from within a function literal that might outlive the\n    iteration of the loop. In Go 1.22, loop variables are created\n    anew for each iteration, so such references are no longer at\n    risk of using a variable after it has been updated by the loop.\n  * vet: New warnings for missing values after append The vet tool\n    now reports calls to append that pass no values to be appended\n    to the slice, such as slice = append(slice). Such a statement\n    has no effect, and experience has shown that is nearly always a\n    mistake.\n  * vet: New warnings for deferring time.Since The vet tool now\n    reports a non-deferred call to time.Since(t) within a defer\n    statement. This is equivalent to calling time.Now().Sub(t)\n    before the defer statement, not when the deferred function is\n    called. In nearly all cases, the correct code requires\n    deferring the time.Since call.\n  * vet: New warnings for mismatched key-value pairs in log/slog\n    calls The vet tool now reports invalid arguments in calls to\n    functions and methods in the structured logging package,\n    log/slog, that accept alternating key/value pairs. It reports\n    calls where an argument in a key position is neither a string\n    nor a slog.Attr, and where a final key is missing its value.\n  * runtime: The runtime now keeps type-based garbage collection\n    metadata nearer to each heap object, improving the CPU\n    performance (latency or throughput) of Go programs by\n    1-3%. This change also reduces the memory overhead of the\n    majority Go programs by approximately 1% by deduplicating\n    redundant metadata. Some programs may see a smaller improvement\n    because this change adjusts the size class boundaries of the\n    memory allocator, so some objects may be moved up a size class.\n    A consequence of this change is that some objects' addresses\n    that were previously always aligned to a 16 byte (or higher)\n    boundary will now only be aligned to an 8 byte boundary. Some\n    programs that use assembly instructions that require memory\n    addresses to be more than 8-byte aligned and rely on the memory\n    allocator's previous alignment behavior may break, but we\n    expect such programs to be rare. Such programs may be built\n    with GOEXPERIMENT=noallocheaders to revert to the old metadata\n    layout and restore the previous alignment behavior, but package\n    owners should update their assembly code to avoid the alignment\n    assumption, as this workaround will be removed in a future\n    release.\n  * runtime: On the windows/amd64 port, programs linking or loading\n    Go libraries built with -buildmode=c-archive or\n    -buildmode=c-shared can now use the SetUnhandledExceptionFilter\n    Win32 function to catch exceptions not handled by the Go\n    runtime. Note that this was already supported on the\n    windows/386 port.\n  * compiler: Profile-guided Optimization (PGO) builds can now\n    devirtualize a higher proportion of calls than previously\n    possible. Most programs from a representative set of Go\n    programs now see between 2 and 14% improvement from enabling\n    PGO.\n  * compiler: The compiler now interleaves devirtualization and\n    inlining, so interface method calls are better optimized.\n  * compiler: go1.22 also includes a preview of an enhanced\n    implementation of the compiler's inlining phase that uses\n    heuristics to boost inlinability at call sites deemed\n    'important' (for example, in loops) and discourage inlining at\n    call sites deemed 'unimportant' (for example, on panic\n    paths). Building with GOEXPERIMENT=newinliner enables the new\n    call-site heuristics; see issue #61502 for more info and to\n    provide feedback.\n  * linker: The linker's -s and -w flags are now behave more\n    consistently across all platforms. The -w flag suppresses DWARF\n    debug information generation. The -s flag suppresses symbol\n    table generation. The -s flag also implies the -w flag, which\n    can be negated with -w=0. That is, -s -w=0 will generate a\n    binary with DWARF debug information generation but without the\n    symbol table.\n  * linker: On ELF platforms, the -B linker flag now accepts a\n    special form: with -B gobuildid, the linker will generate a GNU\n    build ID (the ELF NT_GNU_BUILD_ID note) derived from the Go\n    build ID.\n  * linker: On Windows, when building with -linkmode=internal, the\n    linker now preserves SEH information from C object files by\n    copying the .pdata and .xdata sections into the final\n    binary. This helps with debugging and profiling binaries using\n    native tools, such as WinDbg. Note that until now, C functions'\n    SEH exception handlers were not being honored, so this change\n    may cause some programs to behave differently.\n    -linkmode=external is not affected by this change, as external\n    linkers already preserve SEH information.\n  * bootstrap: As mentioned in the Go 1.20 release notes, go1.22\n    now requires the final point release of Go 1.20 or later for\n    bootstrap. We expect that Go 1.24 will require the final point\n    release of go1.22 or later for bootstrap.\n  * core library: New math/rand/v2 package: go1.22 includes the\n    first “v2” package in the standard library, math/rand/v2. The\n    changes compared to math/rand are detailed in proposal\n    go#61716. The most important changes are:\n    - The Read method, deprecated in math/rand, was not carried\n      forward for math/rand/v2. (It remains available in\n      math/rand.) The vast majority of calls to Read should use\n      crypto/rand’s Read instead. Otherwise a custom Read can be\n      constructed using the Uint64 method.\n    - The global generator accessed by top-level functions is\n      unconditionally randomly seeded. Because the API guarantees\n      no fixed sequence of results, optimizations like per-thread\n      random generator states are now possible.\n    - The Source interface now has a single Uint64 method; there is\n      no Source64 interface.\n    - Many methods now use faster algorithms that were not possible\n      to adopt in math/rand because they changed the output\n      streams.\n    - The Intn, Int31, Int31n, Int63, and Int64n top-level\n      functions and methods from math/rand are spelled more\n      idiomatically in math/rand/v2: IntN, Int32, Int32N, Int64,\n      and Int64N. There are also new top-level functions and\n      methods Uint32, Uint32N, Uint64, Uint64N, Uint, and UintN.\n    - The new generic function N is like Int64N or Uint64N but\n      works for any integer type. For example a random duration\n      from 0 up to 5 minutes is rand.N(5*time.Minute).\n    - The Mitchell \u0026 Reeds LFSR generator provided by math/rand’s\n      Source has been replaced by two more modern pseudo-random\n      generator sources: ChaCha8 PCG. ChaCha8 is a new,\n      cryptographically strong random number generator roughly\n      similar to PCG in efficiency. ChaCha8 is the algorithm used\n      for the top-level functions in math/rand/v2. As of go1.22,\n      math/rand's top-level functions (when not explicitly seeded)\n      and the Go runtime also use ChaCha8 for randomness.\n    - We plan to include an API migration tool in a future release,\n      likely Go 1.23.\n  * core library: New go/version package: The new go/version\n    package implements functions for validating and comparing Go\n    version strings.\n  * core library: Enhanced routing patterns: HTTP routing in the\n    standard library is now more expressive. The patterns used by\n    net/http.ServeMux have been enhanced to accept methods and\n    wildcards. This change breaks backwards compatibility in small\n    ways, some obvious—patterns with '{' and '}' behave\n    differently— and some less so—treatment of escaped paths has\n    been improved. The change is controlled by a GODEBUG field\n    named httpmuxgo121. Set httpmuxgo121=1 to restore the old\n    behavior.\n  * Minor changes to the library As always, there are various minor\n    changes and updates to the library, made with the Go 1 promise\n    of compatibility in mind. There are also various performance\n    improvements, not enumerated here.\n  * archive/tar: The new method Writer.AddFS adds all of the files\n    from an fs.FS to the archive.\n  * archive/zip: The new method Writer.AddFS adds all of the files\n    from an fs.FS to the archive.\n  * bufio: When a SplitFunc returns ErrFinalToken with a nil token,\n    Scanner will now stop immediately. Previously, it would report\n    a final empty token before stopping, which was usually not\n    desired. Callers that do want to report a final empty token can\n    do so by returning []byte{} rather than nil.\n  * cmp: The new function Or returns the first in a sequence of\n    values that is not the zero value.\n  * crypto/tls: ConnectionState.ExportKeyingMaterial will now\n    return an error unless TLS 1.3 is in use, or the\n    extended_master_secret extension is supported by both the\n    server and client. crypto/tls has supported this extension\n    since Go 1.20. This can be disabled with the tlsunsafeekm=1\n    GODEBUG setting.\n  * crypto/tls: By default, the minimum version offered by\n    crypto/tls servers is now TLS 1.2 if not specified with\n    config.MinimumVersion, matching the behavior of crypto/tls\n    clients. This change can be reverted with the tls10server=1\n    GODEBUG setting.\n  * crypto/tls: By default, cipher suites without ECDHE support are\n    no longer offered by either clients or servers during pre-TLS\n    1.3 handshakes. This change can be reverted with the\n    tlsrsakex=1 GODEBUG setting.\n  * crypto/x509: The new CertPool.AddCertWithConstraint method can\n    be used to add customized constraints to root certificates to\n    be applied during chain building.\n  * crypto/x509: On Android, root certificates will now be loaded\n    from /data/misc/keychain/certs-added as well as\n    /system/etc/security/cacerts.\n  * crypto/x509: A new type, OID, supports ASN.1 Object Identifiers\n    with individual components larger than 31 bits. A new field\n    which uses this type, Policies, is added to the Certificate\n    struct, and is now populated during parsing. Any OIDs which\n    cannot be represented using a asn1.ObjectIdentifier will appear\n    in Policies, but not in the old PolicyIdentifiers field. When\n    calling CreateCertificate, the Policies field is ignored, and\n    policies are taken from the PolicyIdentifiers field. Using the\n    x509usepolicies=1 GODEBUG setting inverts this, populating\n    certificate policies from the Policies field, and ignoring the\n    PolicyIdentifiers field. We may change the default value of\n    x509usepolicies in Go 1.23, making Policies the default field\n    for marshaling.\n  * database/sql: The new Null[T] type provide a way to scan\n    nullable columns for any column types.\n  * debug/elf: Constant R_MIPS_PC32 is defined for use with MIPS64\n    systems. Additional R_LARCH_* constants are defined for use\n    with LoongArch systems.\n  * encoding: The new methods AppendEncode and AppendDecode added\n    to each of the Encoding types in the packages encoding/base32,\n    encoding/base64, and encoding/hex simplify encoding and\n    decoding from and to byte slices by taking care of byte slice\n    buffer management.\n  * encoding: The methods base32.Encoding.WithPadding and\n    base64.Encoding.WithPadding now panic if the padding argument\n    is a negative value other than NoPadding.\n  * encoding/json: Marshaling and encoding functionality now\n    escapes '\\b' and '\\f' characters as \\b and \\f instead of \\u0008\n    and \\u000c.\n  * go/ast: The following declarations related to syntactic\n    identifier resolution are now deprecated: Ident.Obj, Object,\n    Scope, File.Scope, File.Unresolved, Importer, Package,\n    NewPackage. In general, identifiers cannot be accurately\n    resolved without type information. Consider, for example, the\n    identifier K in T{K: ''}: it could be the name of a local\n    variable if T is a map type, or the name of a field if T is a\n    struct type. New programs should use the go/types package to\n    resolve identifiers; see Object, Info.Uses, and Info.Defs for\n    details.\n  * go/ast: The new ast.Unparen function removes any enclosing\n    parentheses from an expression.\n  * go/types: The new Alias type represents type\n    aliases. Previously, type aliases were not represented\n    explicitly, so a reference to a type alias was equivalent to\n    spelling out the aliased type, and the name of the alias was\n    lost. The new representation retains the intermediate\n    Alias. This enables improved error reporting (the name of a\n    type alias can be reported), and allows for better handling of\n    cyclic type declarations involving type aliases. In a future\n    release, Alias types will also carry type parameter\n    information. The new function Unalias returns the actual type\n    denoted by an Alias type (or any other Type for that matter).\n  * go/types: Because Alias types may break existing type switches\n    that do not know to check for them, this functionality is\n    controlled by a GODEBUG field named gotypesalias. With\n    gotypesalias=0, everything behaves as before, and Alias types\n    are never created. With gotypesalias=1, Alias types are created\n    and clients must expect them. The default is gotypesalias=0. In\n    a future release, the default will be changed to\n    gotypesalias=1. Clients of go/types are urged to adjust their\n    code as soon as possible to work with gotypesalias=1 to\n    eliminate problems early.\n  * go/types: The Info struct now exports the FileVersions map\n    which provides per-file Go version information.\n  * go/types: The new helper method PkgNameOf returns the local\n    package name for the given import declaration.\n  * go/types: The implementation of SizesFor has been adjusted to\n    compute the same type sizes as the compiler when the compiler\n    argument for SizesFor is 'gc'. The default Sizes implementation\n    used by the type checker is now types.SizesFor('gc', 'amd64').\n  * go/types: The start position (Pos) of the lexical environment\n    block (Scope) that represents a function body has changed: it\n    used to start at the opening curly brace of the function body,\n    but now starts at the function's func token.\n  * html/template: Javascript template literals may now contain Go\n    template actions, and parsing a template containing one will no\n    longer return ErrJSTemplate. Similarly the GODEBUG setting\n    jstmpllitinterp no longer has any effect.\n  * io: The new SectionReader.Outer method returns the ReaderAt,\n    offset, and size passed to NewSectionReader.\n  * log/slog: The new SetLogLoggerLevel function controls the level\n    for the bridge between the `slog` and `log` packages. It sets\n    the minimum level for calls to the top-level `slog` logging\n    functions, and it sets the level for calls to `log.Logger` that\n    go through `slog`.\n  * math/big: The new method Rat.FloatPrec computes the number of\n    fractional decimal digits required to represent a rational\n    number accurately as a floating-point number, and whether\n    accurate decimal representation is possible in the first place.\n  * net: When io.Copy copies from a TCPConn to a UnixConn, it will\n    now use Linux's splice(2) system call if possible, using the\n    new method TCPConn.WriteTo.\n  * net: The Go DNS Resolver, used when building with\n    '-tags=netgo', now searches for a matching name in the Windows\n    hosts file, located at %SystemRoot%\\System32\\drivers\\etc\\hosts,\n    before making a DNS query.\n  * net/http: The new functions ServeFileFS, FileServerFS, and\n    NewFileTransportFS are versions of the existing ServeFile,\n    FileServer, and NewFileTransport, operating on an fs.FS.\n  * net/http: The HTTP server and client now reject requests and\n    responses containing an invalid empty Content-Length\n    header. The previous behavior may be restored by setting\n    GODEBUG field httplaxcontentlength=1.\n  * net/http: The new method Request.PathValue returns path\n    wildcard values from a request and the new method\n    Request.SetPathValue sets path wildcard values on a request.\n  * net/http/cgi: When executing a CGI process, the PATH_INFO\n    variable is now always set to the empty string or a value\n    starting with a / character, as required by RFC 3875. It was\n    previously possible for some combinations of Handler.Root and\n    request URL to violate this requirement.\n  * net/netip: The new AddrPort.Compare method compares two\n    AddrPorts.\n  * os: On Windows, the Stat function now follows all reparse\n    points that link to another named entity in the system. It was\n    previously only following IO_REPARSE_TAG_SYMLINK and\n    IO_REPARSE_TAG_MOUNT_POINT reparse points.\n  * os: On Windows, passing O_SYNC to OpenFile now causes write\n    operations to go directly to disk, equivalent to O_SYNC on Unix\n    platforms.\n  * os: On Windows, the ReadDir, File.ReadDir, File.Readdir, and\n    File.Readdirnames functions now read directory entries in\n    batches to reduce the number of system calls, improving\n    performance up to 30%.\n  * os: When io.Copy copies from a File to a net.UnixConn, it will\n    now use Linux's sendfile(2) system call if possible, using the\n    new method File.WriteTo.\n  * os/exec: On Windows, LookPath now ignores empty entries\n    in %PATH%, and returns ErrNotFound (instead of ErrNotExist)\n    if no executable file extension is found to resolve an\n    otherwise-unambiguous name.\n  * os/exec: On Windows, Command and Cmd.Start no longer call\n    LookPath if the path to the executable is already absolute and\n    has an executable file extension. In addition, Cmd.Start no\n    longer writes the resolved extension back to the Path field, so\n    it is now safe to call the String method concurrently with a\n    call to Start.\n  * reflect: The Value.IsZero method will now return true for a\n    floating-point or complex negative zero, and will return true\n    for a struct value if a blank field (a field named _) somehow\n    has a non-zero value. These changes make IsZero consistent with\n    comparing a value to zero using the language == operator.\n  * reflect: The PtrTo function is deprecated, in favor of\n    PointerTo.\n  * reflect: The new function TypeFor returns the Type that\n    represents the type argument T. Previously, to get the\n    reflect.Type value for a type, one had to use\n    reflect.TypeOf((*T)(nil)).Elem(). This may now be written as\n    reflect.TypeFor[T]().\n  * runtime/metrics: Four new histogram metrics\n    /sched/pauses/stopping/gc:seconds,\n    /sched/pauses/stopping/other:seconds,\n    /sched/pauses/total/gc:seconds, and\n    /sched/pauses/total/other:seconds provide additional details\n    about stop-the-world pauses. The 'stopping' metrics report the\n    time taken from deciding to stop the world until all goroutines\n    are stopped. The 'total' metrics report the time taken from\n    deciding to stop the world until it is started again.\n  * runtime/metrics: The /gc/pauses:seconds metric is deprecated,\n    as it is equivalent to the new /sched/pauses/total/gc:seconds\n    metric.\n  * runtime/metrics: /sync/mutex/wait/total:seconds now includes\n    contention on runtime-internal locks in addition to sync.Mutex\n    and sync.RWMutex.\n  * runtime/pprof: Mutex profiles now scale contention by the\n    number of goroutines blocked on the mutex. This provides a more\n    accurate representation of the degree to which a mutex is a\n    bottleneck in a Go program. For instance, if 100 goroutines are\n    blocked on a mutex for 10 milliseconds, a mutex profile will\n    now record 1 second of delay instead of 10 milliseconds of\n    delay.\n  * runtime/pprof: Mutex profiles also now include contention on\n    runtime-internal locks in addition to sync.Mutex and\n    sync.RWMutex. Contention on runtime-internal locks is always\n    reported at runtime._LostContendedRuntimeLock. A future release\n    will add complete stack traces in these cases.\n  * runtime/pprof: CPU profiles on Darwin platforms now contain the\n    process's memory map, enabling the disassembly view in the\n    pprof tool.\n  * runtime/trace: The execution tracer has been completely\n    overhauled in this release, resolving several long-standing\n    issues and paving the way for new use-cases for execution\n    traces.\n  * runtime/trace: Execution traces now use the operating system's\n    clock on most platforms (Windows excluded) so it is possible to\n    correlate them with traces produced by lower-level\n    components. Execution traces no longer depend on the\n    reliability of the platform's clock to produce a correct\n    trace. Execution traces are now partitioned regularly\n    on-the-fly and as a result may be processed in a streamable\n    way. Execution traces now contain complete durations for all\n    system calls. Execution traces now contain information about\n    the operating system threads that goroutines executed on. The\n    latency impact of starting and stopping execution traces has\n    been dramatically reduced. Execution traces may now begin or\n    end during the garbage collection mark phase.\n  * runtime/trace: To allow Go developers to take advantage of\n    these improvements, an experimental trace reading package is\n    available at golang.org/x/exp/trace. Note that this package\n    only works on traces produced by programs built with go1.22 at\n    the moment. Please try out the package and provide feedback on\n    the corresponding proposal issue.\n  * runtime/trace: If you experience any issues with the new\n    execution tracer implementation, you may switch back to the old\n    implementation by building your Go program with\n    GOEXPERIMENT=noexectracer2. If you do, please file an issue,\n    otherwise this option will be removed in a future release.\n  * slices: The new function Concat concatenates multiple slices.\n  * slices: Functions that shrink the size of a slice (Delete,\n    DeleteFunc, Compact, CompactFunc, and Replace) now zero the\n    elements between the new length and the old length.\n  * slices: Insert now always panics if the argument i is out of\n    range. Previously it did not panic in this situation if there\n    were no elements to be inserted.\n  * syscall: The syscall package has been frozen since Go 1.4 and\n    was marked as deprecated in Go 1.11, causing many editors to\n    warn about any use of the package. However, some non-deprecated\n    functionality requires use of the syscall package, such as the\n    os/exec.Cmd.SysProcAttr field. To avoid unnecessary complaints\n    on such code, the syscall package is no longer marked as\n    deprecated. The package remains frozen to most new\n    functionality, and new code remains encouraged to use\n    golang.org/x/sys/unix or golang.org/x/sys/windows where\n    possible.\n  * syscall: On Linux, the new SysProcAttr.PidFD field allows\n    obtaining a PID FD when starting a child process via\n    StartProcess or os/exec.\n  * syscall: On Windows, passing O_SYNC to Open now causes write\n    operations to go directly to disk, equivalent to O_SYNC on Unix\n    platforms.\n  * testing/slogtest: The new Run function uses sub-tests to run\n    test cases, providing finer-grained control.\n  * Ports: Darwin: On macOS on 64-bit x86 architecture (the\n    darwin/amd64 port), the Go toolchain now generates\n    position-independent executables (PIE) by default. Non-PIE\n    binaries can be generated by specifying the -buildmode=exe\n    build flag. On 64-bit ARM-based macOS (the darwin/arm64 port),\n    the Go toolchain already generates PIE by default. go1.22 is\n    the last release that will run on macOS 10.15 Catalina. Go 1.23\n    will require macOS 11 Big Sur or later.\n  * Ports: Arm: The GOARM environment variable now allows you to\n    select whether to use software or hardware floating\n    point. Previously, valid GOARM values were 5, 6, or 7. Now\n    those same values can be optionally followed by ,softfloat or\n    ,hardfloat to select the floating-point implementation. This\n    new option defaults to softfloat for version 5 and hardfloat\n    for versions 6 and 7.\n  * Ports: Loong64: The loong64 port now supports passing function\n    arguments and results using registers. The linux/loong64 port\n    now supports the address sanitizer, memory sanitizer, new-style\n    linker relocations, and the plugin build mode.\n  * OpenBSD go1.22 adds an experimental port to OpenBSD on\n    big-endian 64-bit PowerPC (openbsd/ppc64).\n","status":"published","published":"2024-11-07T10:08:23Z","modified":"2026-02-04T03:08:38.039208Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n\ngrafana was updated to version 12.4.10:\n\n- Security issues:\n\n  * CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)\n  * CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)\n  * CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973)\n  * CVE-2026-19475: Fixed DoS risks in PostgreSQL Datasource by checking timeGroup macros (bsc#1278307)\n  * CVE-2026-14199: Fixed auth bypass or session takeover via Auth Proxy cache key collision (bsc#1278322)\n  * CVE-2026-19197: Fixed access control and authorization checks in dashboard snapshots (bsc#1277025)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm (bsc#1272008)\n  * CVE-2026-41178: Fixed denial-of-service risks in OpenTelemetry baggage parsing (bsc#1276658)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274217)\n  * CVE-2026-8595: Fixed stored XSS via malicious dashboard field names in table panels (bsc#1271557)\n  * CVE-2026-42127: Fixed DoS risks in the public dashboard query endpoint (bsc#1268868)\n  * CVE-2026-9029: Fixed arbitrary code execution and script injection in the geomap panel (bsc#1272328)\n  * CVE-2026-33814: Fixed infinite loop in HTTP/2 transport during framesize check (bsc#1265763)\n  * CVE-2026-8609: Fixed pre-authentication denial-of-service risks in OAuth login routes (bsc#1271330)\n  * CVE-2026-1229: Fixed incorrect value calculation in ecc/p384 Package (bsc#1265525, bsc#1262187)\n  * CVE-2025-12141: Fixed information disclosure of secure settings via contact point modification (bsc#1262187)\n  * CVE-2026-21723: Fixed out-of-memory and denial-of-service risks in templates test endpoint (bsc#1272427)\n  * CVE-2026-41606: Fixed denial-of-service risks from nested messages in Apache Thrift parser (bsc#1263330)\n\n- Bug fixes and changes:\n\n  * Dashboards: Fix adhoc and groupby variable datasource on UI import\n  * Dashboards: Fix version dates and user display names in the legacy version history page\n  * Dashboard Import: Labels in v2 schema\n  * Azure Monitor: fix migration for dimension filters\n  * Dashboards: Get annotations and dashboard endpoint performance improvements\n  * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading\n  * Alerting: Add protected fields authorization check to provisioning API\n  * Alerting: Return 403 instead of 500 on contact point provenance mismatch\n  * Jaeger: Handle gzip, deflate, and brotli compressed API responses\n  * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7:\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:24:34Z","modified":"2026-10-08T19:15:05.011279037Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4606-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n  \n  ","status":"published","published":"2026-10-09T12:30:05Z","modified":"2026-10-10T09:30:06.444759656Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-6886-1","title":"golang-1.21, golang-1.22 vulnerabilities","description":"It was discovered that the Go net/http module did not properly handle the\nrequests when request\\'s headers exceed MaxHeaderBytes. An attacker could\npossibly use this issue to cause a panic resulting into a denial of service.\nThis issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2023-45288)\n\nIt was discovered that the Go net/http module did not properly validate the\nsubdomain match or exact match of the initial domain. An attacker could\npossibly use this issue to read sensitive information. This issue only\naffected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-45289)\n\nIt was discovered that the Go net/http module did not properly validate the\ntotal size of the parsed form when parsing a multipart form. An attacker\ncould possibly use this issue to cause a panic resulting into a denial of\nservice. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu\n22.04 LTS. (CVE-2023-45290)\n\nIt was discovered that the Go crypto/x509 module did not properly handle a\ncertificate chain which contains a certificate with an unknown public key\nalgorithm. An attacker could possibly use this issue to cause a panic\nresulting into a denial of service. This issue only affected Go 1.21 in\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-24783)\n\nIt was discovered that the Go net/mail module did not properly handle\ncomments within display names in the ParseAddressList function. An\nattacker could possibly use this issue to cause a panic resulting into a\ndenial of service. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2024-24784)\n\nIt was discovered that the Go html/template module did not validate errors\nreturned from MarshalJSON methods. An attacker could possibly use this\nissue to inject arbitrary code into the Go template. This issue only\naffected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-24785)\n\nIt was discovered that the Go net module did not properly validate the DNS\nmessage in response to a query. An attacker could possibly use this issue\nto cause a panic resulting into a denial of service. This issue only\naffected Go 1.22. (CVE-2024-24788)\n\nIt was discovered that the Go archive/zip module did not properly handle\ncertain types of invalid zip files differs from the behavior of most zip\nimplementations. An attacker could possibly use this issue to cause a panic\nresulting into a denial of service. (CVE-2024-24789)\n\nIt was discovered that the Go net/netip module did not work as expected\nfor IPv4-mapped IPv6 addresses in various Is methods. An attacker could\npossibly use this issue to cause a panic resulting into a denial of service.\n(CVE-2024-24790)\n","status":"published","published":"2024-07-09T12:12:13Z","modified":"2026-04-27T17:19:01.861632Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}