FlawAtlas
Search the atlas
SUSE-SU-2025:03524-1 Not scored

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to version 1.25.1, released 2025-09-03 (bsc#1244485). Security issues fixed: - CVE-2025-47910: net/http: `CrossOriginProtection` insecure bypass patterns not limited to exact matches (bsc#1249141). Other issues fixed: - go#74822 cmd/go: 'get toolchain@latest' should ignore release candidates - go#74999 net: WriteMsgUDPAddrPort should accept IPv4-mapped IPv6 destination addresses on IPv4 UDP sockets - go#75008 os/exec: TestLookPath fails on plan9 after CL 685755 - go#75021 testing/synctest: bubble not terminating - go#75083 os: File.Seek doesn't set the correct offset with Windows overlapped handles

Exploit probability Not scored
Published October 10, 2025
Required by Not available
Last source change March 23, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Enterprise Storage 7.1 go1.25-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS go1.25-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS go1.25-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS go1.25-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS go1.25-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS go1.25-openssl
SUSE:Linux Enterprise Server 15 SP3-LTSS go1.25-openssl
SUSE:Linux Enterprise Server 15 SP4-LTSS go1.25-openssl
SUSE:Linux Enterprise Server 15 SP5-LTSS go1.25-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 go1.25-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 go1.25-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 go1.25-openssl

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2025:03524-1

This update for go1.25-openssl fixes the following issues: Update to version 1.25.1, released 2025-09-03 (bsc#1244485). Security issues fixed: - CVE-2025-47910: net/http: `CrossOriginProtection` insecure bypass patterns not limited to exact matches (bsc#1249141). Other issues fixed: - go#74822 cmd/go: 'get toolchain@latest' should ignore release candidates - go#74999 net: WriteMsgUDPAddrPort should accept IPv4-mapped IPv6 destination addresses on IPv4 UDP sockets - go#75008 os/exec: TestLookPath fails on plan9 after CL 685755 - go#75021 testing/synctest: bubble not terminating - go#75083 os: File.Seek doesn't set the correct offset with Windows overlapped handles

View original source

05 / REFERENCES

Further evidence