Security update for go1.22-openssl
This update for go1.22-openssl fixes the following issues: Update to version 1.22.12 (bsc#1218424): Security fixes: - CVE-2024-45336: net/http: sensitive headers incorrectly sent after cross-domain redirect (bsc#1236046) - CVE-2024-45341: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (bsc#1236045) - CVE-2025-22866: crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le (bsc#1236801)
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for go1.22-openssl fixes the following issues: Update to version 1.22.12 (bsc#1218424): Security fixes: - CVE-2024-45336: net/http: sensitive headers incorrectly sent after cross-domain redirect (bsc#1236046) - CVE-2024-45341: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (bsc#1236045) - CVE-2025-22866: crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le (bsc#1236801)
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1218424
- https://bugzilla.suse.com/1236045
- https://bugzilla.suse.com/1236046
- https://bugzilla.suse.com/1236801
- https://www.suse.com/security/cve/CVE-2024-45336
- https://www.suse.com/security/cve/CVE-2024-45341
- https://www.suse.com/security/cve/CVE-2025-22866
- https://www.suse.com/support/update/announcement/2025/suse-su-20251555-1/