{"id":"CVE-2025-0913","aliases":["ALPINE-CVE-2025-0913","AZL-78978","AZL-98823","BELL-CVE-2025-0913","BIT-golang-2025-0913","EUVD-2025-18139","GHSA-jw54-c8rr-pjpq","GO-2025-3750","MGASA-2025-0184","SUSE-SU-2025:01846-1","SUSE-SU-2025:01848-1","SUSE-SU-2025:02120-1","SUSE-SU-2025:03158-1","SUSE-SU-2025:03159-1","UBUNTU-CVE-2025-0913","openSUSE-SU-2025:15223-1","openSUSE-SU-2025:15224-1","openSUSE-SU-2025:15225-1","openSUSE-SU-2025:15586-1"],"status":"published","title":"Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00327,"percentile":0.26104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2025-06-09T18:14:56Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.24.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.24.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.24.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"go","fixed_in":["1.23.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"go","fixed_in":["1.24.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"go","fixed_in":["1.24.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"go","fixed_in":["1.23.10-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"go","fixed_in":["1.24.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"go","fixed_in":["1.24.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.23.10","1.24.4"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.23.10","1.24.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.24.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.24.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.24.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.23.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.24.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.24.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.23.10-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.24.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.24.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.10"},{"introduced":"1.24.0-0"},{"fixed":"1.24.4"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.10"},{"introduced":"1.24.0-0"},{"fixed":"1.24.4"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-150000.1.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-150000.1.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.6-150600.13.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.6-150600.13.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"go1.24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.6-150600.13.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"go1.23-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.12-150600.13.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.23-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.12-150600.13.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"go1.23-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.12-150600.13.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~20.04.1","1.22.2-2~20.04.2","1.22.2-2~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~22.04","1.22.2-2~22.04.1","1.22.2-2~22.04.2","1.22.2-2~22.04.3","1.22.2-2~22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2","1.22.2-2ubuntu0.1","1.22.2-2ubuntu0.2","1.22.2-2ubuntu0.3","1.22.2-2ubuntu0.4","1.22.2-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.8-1","1.23.10-1","1.23.10-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1","1.24.2-2","1.24.4-1","1.24.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.10-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.4-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250612T141001-1.1"}]}],"bundled":29},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubecolor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1.1"}]}],"bundled":2}],"products":[{"vendor":"go standard library","product":"os"},{"vendor":"go standard library","product":"syscall"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://go.dev/cl/672396","tags":["Issue Tracking","report","web","fix"]},{"url":"https://go.dev/issue/73702","tags":["Issue Tracking","report","web"]},{"url":"https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A","tags":["Mailing List","discussion","web"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3750","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0913","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jw54-c8rr-pjpq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-0913","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-0913","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0913.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0184.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34353","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/05/5","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501846-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236217","tags":["report"]},{"url":"https://bugzilla.suse.com/1242715","tags":["report"]},{"url":"https://bugzilla.suse.com/1244156","tags":["report"]},{"url":"https://bugzilla.suse.com/1244157","tags":["report"]},{"url":"https://bugzilla.suse.com/1244158","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501848-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229122","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502120-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503158-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246118","tags":["report"]},{"url":"https://bugzilla.suse.com/1247719","tags":["report"]},{"url":"https://bugzilla.suse.com/1247720","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47907","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503159-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236045","tags":["report"]},{"url":"https://bugzilla.suse.com/1236046","tags":["report"]},{"url":"https://bugzilla.suse.com/1236801","tags":["report"]},{"url":"https://bugzilla.suse.com/1238572","tags":["report"]},{"url":"https://bugzilla.suse.com/1240550","tags":["report"]},{"url":"https://bugzilla.suse.com/1247816","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22871","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-0913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-0913","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49140","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-0913","title":"Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T17:17:25.606Z","modified":"2025-06-11T17:37:52.111Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:53.81273Z"}],"euvd":[{"id":"EUVD-2025-18139","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T17:17:25Z","modified":"2025-06-11T17:37:52Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:24.98161Z"}],"ghsa":[{"id":"GHSA-jw54-c8rr-pjpq","title":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the...","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T18:35:43Z","modified":"2025-08-08T15:30:33Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:03:12.931908Z"}],"nvd":[{"id":"CVE-2025-0913","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T18:15:24.627Z","modified":"2026-06-17T08:27:21.723Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:11:11.789448Z"}],"osv":[{"id":"ALPINE-CVE-2025-0913","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T18:15:24.627Z","modified":"2026-11-03T06:33:00.039267809Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2025-0913","status":"published","published":"2025-06-10T06:00:55.108207Z","modified":"2026-01-26T09:41:19.800542Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-0913","title":"Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T17:17:25.606Z","modified":"2026-10-28T02:30:48.072356977Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"UBUNTU-CVE-2025-0913","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T18:15:00Z","modified":"2026-10-19T17:00:09.408458091Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-78978","title":"CVE-2025-0913 affecting package golang 1.26.10-1","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T18:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-98823","title":"CVE-2025-0913 affecting package golang 1.27.1-1","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T18:15:24Z","modified":"2026-09-16T06:39:01Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BIT-golang-2025-0913","title":"Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-14T05:46:34.191Z","modified":"2026-09-08T08:47:49.476528434Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2025-3750","title":"Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall","description":"os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.","status":"published","published":"2025-06-11T16:59:06Z","modified":"2026-02-04T03:28:12.135241Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"MGASA-2025-0184","title":"Updated golang packages fix security vulnerabilities","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on\ncross-origin redirects potentially leaking sensitive information.\nCVE-2025-4673.\nos: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows\nos.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and\nWindows systems when the target path was a dangling symlink. On Unix\nsystems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks.\nOn Windows, when the target path was a symlink to a nonexistent\nlocation, OpenFile would create a file in that location - CVE-2025-0913.\ncrypto/x509: usage of ExtKeyUsageAny disables policy validation. Calling\nVerify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny\nunintentionally disabledpolicy validation. This only affected\ncertificate chains which contain policy graphs, which are rather\nuncommon - CVE-2025-22874.\nOpenFile now always returns an error when the O_CREATE and O_EXCL\nflags are both set and the target path is a symlink.\n","status":"published","published":"2025-06-09T18:14:56Z","modified":"2026-04-16T04:42:21.946897264Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15223-1","title":"go1.23-1.23.10-1.1 on GA media","description":"These are all security issues fixed in the go1.23-1.23.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.752375Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15224-1","title":"go1.24-1.24.4-1.1 on GA media","description":"These are all security issues fixed in the go1.24-1.24.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.803537Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15225-1","title":"govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.823164Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15586-1","title":"kubecolor-0.5.2-1.1 on GA media","description":"These are all security issues fixed in the kubecolor-0.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-29T00:00:00Z","modified":"2026-03-23T04:53:58.372867Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:01846-1","title":"Security update for go1.24","description":"This update for go1.24 fixes the following issues:\n\ngo1.24.4 (released 2025-06-05) includes security fixes to the\ncrypto/x509, net/http, and os packages, as well as bug fixes to\nthe linker, the go command, and the hash/maphash and os packages.\n( bsc#1236217 go1.24 release tracking CVE-2025-22874 CVE-2025-0913 CVE-2025-4673)\n\n* CVE-2025-22874: crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158)\n* CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)\n* CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)\n* os: Root.Mkdir creates directories with zero permissions on OpenBSD\n* hash/maphash: hashing channels with purego impl. of maphash.Comparable panics\n* runtime/debug: BuildSetting does not document DefaultGODEBUG\n* cmd/go: add fips140 module selection mechanism\n* cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen\n* CVE-2025-22873: os: Root permits access to parent directory","status":"published","published":"2025-06-09T18:34:01Z","modified":"2026-02-04T03:49:59.880421Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01848-1","title":"Security update for go1.23","description":"This update for go1.23 fixes the following issues:\n\ngo1.23.10 (released 2025-06-05) includes security fixes to the\n/http and os packages, as well as bug fixes to the linker.\n(bsc#1229122 go1.23 release tracking CVE-2025-0913 CVE-2025-4673)\n\n* CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)\n* CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)\n\n  * runtime/debug: BuildSetting does not document DefaultGODEBUG\n  * cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen\n","status":"published","published":"2025-06-09T18:35:17Z","modified":"2026-02-04T03:17:25.692179Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02120-1","title":"Security update for go1.24-openssl","description":"This update for go1.24-openssl fixes the following issues:\n\nUpdate to version 1.24.4 (bsc#1236217):\n\n- CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158).\n- CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157).\n- CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156).\n","status":"published","published":"2025-06-26T08:22:45Z","modified":"2026-03-23T04:46:27.448211Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:03158-1","title":"Security update for go1.24-openssl","description":"\nThis security update of go1.24-openssl fixes the following issues:\n\nUpdate to version 1.24.6 cut from the go1.24-fips-release\nbranch at the revision tagged go1.24.6-1-openssl-fips.\nRefs jsc#SLE-18320\n\n* Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil\n  salt to be passed as a hash length buffer of zeros.\n\ngo1.24.6 (released 2025-08-06) includes security fixes to the\ndatabase/sql and os/exec packages, as well as bug fixes to the\nruntime.  ( boo#1236217 go1.24 release tracking)\n\nCVE-2025-47906 CVE-2025-47907:\n\n* go#74804 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations\n* go#74833 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan\n\n* go#73800 runtime: RSS seems to have increased in Go 1.24 while the runtime accounting has not\n* go#74416 runtime: use-after-free of allpSnapshot in findRunnable\n* go#74694 runtime: segfaults in runtime.(*unwinder).next\n* go#74760 os/user:nolibgcc: TestGroupIdsTestUser failures\n\ngo1.24.5 (released 2025-07-08) includes security fixes to the go\ncommand, as well as bug fixes to the compiler, the linker, the , and\nthe go command.  ( boo#1236217 go1.24 release tracking)\nj\nCVE-2025-4674:\n\n* go#74381 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module\n\n* go#73908 runtime: bad frame pointer during panic during duffcopy\n* go#74098 cmd/compile: regression on ppc64le bit operations\n* go#74113 cmd/go: crash on unknown GOEXPERIMENT during toolchain selection\n* go#74290 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning\n* go#74294 internal/trace: stress tests triggering suspected deadlock in tracer\n* go#74346 runtime: memlock not unlocked in all control flow paths in sysReserveAlignedSbrk\n* go#74363 runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile\n* go#74403 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN\n\ngo1.24.4 (released 2025-06-05) includes security fixes to the\ncrypto/x509, net/http, and os packages, as well as bug fixes to\nthe linker, the go command, and the hash/maphash and os packages.\n( boo#1236217 go1.24 release tracking)\n\nCVE-2025-22874 CVE-2025-0913 CVE-2025-4673\n* go#73700 go#73702 boo#1244158 security: fix CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation\n* go#73720 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows\n* go#73906 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect\n\n* go#73570 os: Root.Mkdir creates directories with zero permissions on OpenBSD\n* go#73669 hash/maphash: hashing channels with purego impl. of maphash.Comparable panics\n* go#73678 runtime/debug: BuildSetting does not document DefaultGODEBUG\n* go#73809 cmd/go: add fips140 module selection mechanism\n* go#73832 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen\n","status":"published","published":"2025-09-11T03:04:46Z","modified":"2026-02-04T02:31:26.119585Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03159-1","title":"Security update for go1.23-openssl","description":"\nThis update for go1.23-openssl fixes the following issues:\n\nUpdate  to version 1.23.12 cut from the go1.23-fips-release branch at\nthe revision tagged go1.23.12-1-openssl-fips.  ( jsc#SLE-18320)\n\n  * Rebase to 1.23.12\n  * Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil\n    salt to be passed as a hash length buffer of zeros.\n\nPackaging improvements:\n\n  * Update go_bootstrap_version to go1.21 from go1.20 to shorten\n    the bootstrap chain. go1.21 can optionally be bootstrapped with\n    gccgo and serve as the inital version of go1.x.\n  * Refs boo#1247816 bootstrap go1.21 with gccgo\n\ngo1.23.12 (released 2025-08-06) includes security fixes to the\ndatabase/sql and os/exec packages, as well as bug fixes to the\nruntime.\n\nCVE-2025-47906 CVE-2025-47907:\n  * go#74803 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations\n  * go#74832 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan\n\n  * go#74415 runtime: use-after-free of allpSnapshot in findRunnable\n  * go#74693 runtime: segfaults in runtime.(*unwinder).next\n  * go#74721 cmd/go: TestScript/build_trimpath_cgo fails to decode dwarf on release-branch.go1.23\n  * go#74726 cmd/cgo/internal/testsanitizers: failures with signal: segmentation fault or exit status 66\n\ngo1.23.11 (released 2025-07-08) includes security fixes to the go\ncommand, as well as bug fixes to the compiler, the linker, and\nthe runtime.\n\nCVE-2025-4674:\n  * go#74382 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module\n\n  * go#73907 runtime: bad frame pointer during panic during duffcopy\n  * go#74289 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning\n  * go#74293 internal/trace: stress tests triggering suspected deadlock in tracer\n  * go#74362 runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile\n  * go#74402 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN\n\ngo1.23.10 (released 2025-06-05) includes security fixes to the\nnet/http and os packages, as well as bug fixes to the linker.  (boo#1229122 go1.23 release tracking)\n\nCVE-2025-0913 CVE-2025-4673:\n  * go#73719 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows\n  * go#73905 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect\n\n  * go#73677 runtime/debug: BuildSetting does not document DefaultGODEBUG\n  * go#73831 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen\n\ngo1.23.9 (released 2025-05-06) includes fixes to the runtime and\nthe linker.  (boo#1229122 go1.23 release tracking)\n\n  * go#73091 cmd/link: linkname directive on userspace variable can override runtime variable\n  * go#73380 runtime, x/sys/unix: Connectx is broken on darwin/amd64\n\ngo1.23.8 (released 2025-04-01) includes security fixes to the\nnet/http package, as well as bug fixes to the runtime and the go\ncommand.\n\n  CVE-2025-22871:\n  * go#72010 go#71988 boo#1240550 security: fix CVE-2025-22871 net/http: reject bare LF in chunked encoding\n\n  * go#72114 runtime: process hangs for mips hardware\n  * go#72871 runtime: cgo callback on extra M treated as external code after nested cgo callback returns\n  * go#72937 internal/godebugs: winsymlink and winreadlinkvolume have incorrect defaults for Go 1.22\n\ngo1.23.7 (released 2025-03-04) includes security fixes to the\nnet/http package, as well as bug fixes to cgo, the compiler, and\nthe reflect, runtime, and syscall packages.\n\n  CVE-2025-22870:\n  * go#71985 go#71984 boo#1238572 security: fix CVE-2025-22870 net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs\n\n  * go#71727 runtime: usleep computes wrong tv_nsec on s390x\n  * go#71839 runtime: recover added in range-over-func loop body doesn't stop panic propagation / segfaults printing error\n  * go#71848 os: spurious SIGCHILD on running child process\n  * go#71875 reflect: Value.Seq panicking on functional iterator methods\n  * go#71915 reflect: Value.Seq iteration value types not matching the type of given int types\n  * go#71962 runtime/cgo: does not build with -Wdeclaration-after-statement\n\ngo1.23.6 (released 2025-02-04) includes security fixes to the\ncrypto/elliptic package, as well as bug fixes to the compiler and\nthe go command.\n\n  CVE-2025-22866\n  * go#71423 go#71383 boo#1236801 security: fix CVE-2025-22866 crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le\n\n  * go#71263 cmd/go/internal/modfetch/codehost: test fails with git 2.47.1\n  * go#71230 cmd/compile: broken write barrier\n\ngo1.23.5 (released 2025-01-16) includes security fixes to the\ncrypto/x509 and net/http packages, as well as bug fixes to the\ncompiler, the runtime, and the net package.\n\n  CVE-2024-45341 CVE-2024-45336:\n  * go#71208 go#71156 boo#1236045 security: fix CVE-2024-45341 crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints\n  * go#71211 go#70530 boo#1236046 security: fix CVE-2024-45336 net/http: sensitive headers incorrectly sent after cross-domain redirect\n\n  * go#69988 runtime: severe performance drop for cgo calls in go1.22.5\n  * go#70517 cmd/compile/internal/importer: flip enable alias to true\n  * go#70789 os: io.Copy(net.Conn, os.Stdin) on MacOS terminate immediately without waiting for input\n  * go#71104 crypto/tls: TestVerifyConnection/TLSv12 failures\n  * go#71147 internal/trace: TestTraceCPUProfile/Stress failures\n\ngo1.23.4 (released 2024-12-03) includes fixes to the compiler,\nthe runtime, the trace command, and the syscall package.\n\n  * go#70644 crypto/rsa: new key generation prohibitively slow under race detector\n  * go#70645 proposal: go/types: add Scope.Node convenience getter\n  * go#70646 x/tools/gopls: unimported completion corrupts import decl (client=BBEdit)\n  * go#70648 crypto/tls: TestHandshakeClientECDHEECDSAAESGCM/TLSv12 failures\n  * go#70649 x/benchmarks/sweet/cmd/sweet: TestSweetEndToEnd failures\n  * go#70650 crypto/tls: TestGetClientCertificate/TLSv13 failures\n  * go#70651 x/tools/go/gcexportdata: simplify implementation assuming go \u003e= 1.21\n  * go#70654 cmd/go: Incorrect output from go list\n  * go#70655 x/build/cmd/relui: add workflows for some remaining manual recurring Go major release cycle tasks\n  * go#70657 proposal: bufio: Scanner.IterText/Scanner.IterBytes\n  * go#70658 x/net/http2: stuck extended CONNECT requests\n  * go#70659 os: TestRootDirFS failures on linux-mips64 and linux-mips64le arch-mips\n  * go#70660 crypto/ecdsa: TestRFC6979 failures on s390x\n  * go#70664 x/mobile: target maccatalyst cannot find OpenGLES header\n  * go#70665 x/tools/gopls: refactor.extract.variable fails at package level\n  * go#70666 x/tools/gopls: panic in GetIfaceStubInfo\n  * go#70667 proposal: crypto/x509: support extracting X25519 public keys from certificates\n  * go#70668 proposal: x/mobile: better support for unrecovered panics\n  * go#70669 cmd/go: local failure in TestScript/build_trimpath_cgo\n  * go#70670 cmd/link: unused functions aren't getting deadcoded from the binary\n  * go#70674 x/pkgsite: package removal request for https://pkg.go.dev/github.com/uisdevsquad/go-test/debugmate\n  * go#70675 cmd/go/internal/lockedfile: mountrpc flake in TestTransform on plan9\n  * go#70677 all: remote file server I/O flakiness with 'Bad fid' errors on plan9\n  * go#70678 internal/poll: deadlock on 'Intel(R) Xeon(R) Platinum' when an FD is closed\n  * go#70679 mime/multipart: With go 1.23.3, mime/multipart does not link\n\nUpdate  to version 1.23.2.3 cut from the go1.23-fips-release\nbranch at the revision tagged go1.23.2-3-openssl-fips.  ( jsc#SLE-18320)\n\n* Add negative tests for openssl (#243)\n\ngo1.23.3 (released 2024-11-06) includes fixes to the linker, the runtime, and the net/http, os, and syscall packages.\n\n  * go#69258 runtime: corrupted GoroutineProfile stack traces\n  * go#69259 runtime: multi-arch build via qemu fails to exec go binary\n  * go#69640 os: os.checkPidfd() crashes with SIGSYS\n  * go#69746 runtime: TestGdbAutotmpTypes failures\n  * go#69848 cmd/compile: syscall.Syscall15: nosplit stack over 792 byte limit\n  * go#69865 runtime: MutexProfile missing root frames in go1.23\n  * go#69882 time,runtime: too many concurrent timer firings for short time.Ticker\n  * go#69978 time,runtime: too many concurrent timer firings for short, fast-resetting time.Timer\n  * go#69992 cmd/link: LC_UUID not generated by go linker, resulting in failure to access local network on macOS 15\n  * go#70001 net/http/pprof: coroutines + pprof makes the program panic\n  * go#70020 net/http: short writes with FileServer on macos\n","status":"published","published":"2025-09-11T03:05:02Z","modified":"2026-02-04T04:01:40.963287Z","updated_at":"2026-11-02T15:53:57.111474Z"}]}}