{"id":"CVE-2025-297850","aliases":["openSUSE-SU-2025:15193-1","openSUSE-SU-2025:15195-1","openSUSE-SU-2025:20128-1"],"status":"published","title":"golang-github-teddysun-v2ray-plugin-5.25.0-1.1 on GA media","description":"These are all security issues fixed in the golang-github-teddysun-v2ray-plugin-5.25.0-1.1 package on the GA media of openSUSE Tumbleweed.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-06-02T00:00:00Z","modified":"2026-03-23T04:54:17Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"shadowsocks-v2ray-plugin","fixed_in":["5.25.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"v2ray-core","fixed_in":["5.33.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"shadowsocks-v2ray-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.33.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"shadowsocks-v2ray-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.0-bp160.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.0-bp160.1.1"}]}],"bundled":2}],"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6VC5VIU6SCJITOKTLOBAGZU62Z2CRZJH/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-297850","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JV7NP5OZ7ALMJGBCJN5YCPVJGO2QVZPR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235164","tags":["report"]},{"url":"https://bugzilla.suse.com/1243946","tags":["report"]},{"url":"https://bugzilla.suse.com/1243954","tags":["report"]},{"url":"https://bugzilla.suse.com/1251404","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]}],"sources":{"osv":[{"id":"openSUSE-SU-2025:15193-1","title":"golang-github-teddysun-v2ray-plugin-5.25.0-1.1 on GA media","description":"These are all security issues fixed in the golang-github-teddysun-v2ray-plugin-5.25.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-06-02T00:00:00Z","modified":"2026-03-23T04:53:28.309242Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15195-1","title":"golang-github-v2fly-v2ray-core-5.33.0-1.1 on GA media","description":"These are all security issues fixed in the golang-github-v2fly-v2ray-core-5.33.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-06-02T00:00:00Z","modified":"2026-03-23T04:53:28.38497Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:20128-1","title":"Security update for shadowsocks-v2ray-plugin, v2ray-core","description":"This update for shadowsocks-v2ray-plugin, v2ray-core fixes the following issues:\n\nChanges in shadowsocks-v2ray-plugin:\n\n- Update version to 5.25.0\n  * Update v2ray-core to v5.25.0\n- Add update-vendor.patch, update v2ray-core to v5.33.0 (boo#1243954 and CVE-2025-297850)\n\nChanges in v2ray-core:\n\n- Fix CVE-2025-47911 and boo#1251404\n  * Add fix-CVE-2025-47911.patch\n  * Update golang.org/x/net to 0.45.0 in vendor\n\n- Update version to 5.38.0\n  * TLSMirror Connection Enrollment System\n  * Add TLSMirror Sequence Watermarking\n  * LSMirror developer preview protocol is now a part of mainline V2Ray\n  * proxy dns with NOTIMP error\n  * Add TLSMirror looks like TLS censorship resistant transport protocol\n    as a developer preview transport\n  * proxy dns with NOTIMP error\n  * fix false success from SOCKS server when Dispatch() fails\n  * HTTP inbound: Directly forward plain HTTP 1xx response header\n  * add a option to override domain used to query https record\n  * Fix bugs\n  * Update vendor\n\n- Update version to 5.33.0\n  * bump github.com/quic-go/quic-go from 0.51.0 to 0.52.0(boo#1243946 and CVE-2025-297850)\n  * Update other vendor source\n\n- Update version to 5.31.0\n  * Add Dns Proxy Response TTL Control\n  * Fix call newError Base with a nil value error\n  * Update vendor (boo#1235164)\n\n- Update version to 5.29.3\n  * Enable restricted mode load for http protocol client\n  * Correctly implement QUIC sniffer when handling multiple initial packets\n  * Fix unreleased cache buffer in QUIC sniffing\n  * A temporary testing fix for the buffer corruption issue\n  * QUIC Sniffer Restructure\n\n- Update version to 5.22.0\n  * Add packetEncoding for Hysteria\n  * Add ECH Client Support\n  * Add support for parsing some shadowsocks links\n  * Add Mekya Transport\n  * Fix bugs\n","status":"published","published":"2025-12-30T17:02:04Z","modified":"2026-03-23T04:54:17.912892Z","updated_at":"2026-11-02T16:58:38.101535Z"}]}}