FlawAtlas
Search the atlas
SUSE-SU-2025:01731-1 Not scored

Security update for go1.23-openssl

This update for go1.23-openssl fixes the following issues: Update to version 1.23.9 (bsc#1229122): Security fixes: - CVE-2024-45336: net/http: sensitive headers incorrectly sent after cross-domain redirect (bsc#1236046) - CVE-2024-45341: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (bsc#1236045) - CVE-2025-22866: crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le (bsc#1236801) - CVE-2025-22870: net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs (bsc#1238572) - CVE-2025-22871: net/http: reject bare LF in chunked encoding (bsc#1240550)

Exploit probability Not scored
Published May 28, 2025
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Enterprise Storage 7.1 go1.23-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS go1.23-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS go1.23-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS go1.23-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS go1.23-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS go1.23-openssl
SUSE:Linux Enterprise Server 15 SP3-LTSS go1.23-openssl
SUSE:Linux Enterprise Server 15 SP4-LTSS go1.23-openssl
SUSE:Linux Enterprise Server 15 SP5-LTSS go1.23-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 go1.23-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 go1.23-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 go1.23-openssl

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2025:01731-1

This update for go1.23-openssl fixes the following issues: Update to version 1.23.9 (bsc#1229122): Security fixes: - CVE-2024-45336: net/http: sensitive headers incorrectly sent after cross-domain redirect (bsc#1236046) - CVE-2024-45341: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (bsc#1236045) - CVE-2025-22866: crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le (bsc#1236801) - CVE-2025-22870: net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs (bsc#1238572) - CVE-2025-22871: net/http: reject bare LF in chunked encoding (bsc#1240550)

View original source

05 / REFERENCES

Further evidence