Vulnerability-Lookup

RHSA-2025:3773

Vulnerability from csaf_opensuse - Published: 2025-04-10 00:00 - Updated: 2026-10-11 11:38

Summary

security update for delve

Severity

Important

Notes

Title of the patch: security update for delve

Description of the patch: This security update provides a functional equivalent of RHSA-2025:3773. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2025:3773.

Patchnames: RHSA-2025:3773

CVE-2024-34156

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2024-45336

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 18 products, the same list as for CVE-2024-34156

Threats

Impact moderate

CVE-2024-45341

4.2 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Recommended 18 products, the same list as for CVE-2024-34156

Threats

Impact moderate

CVE-2025-22866

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 18 products, the same list as for CVE-2024-34156

Threats

Impact moderate

References

17 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2024-34156/	self
https://www.suse.com/security/cve/CVE-2024-45336/	self
https://www.suse.com/security/cve/CVE-2024-45341/	self
https://www.suse.com/security/cve/CVE-2025-22866/	self
https://www.suse.com/security/cve/CVE-2024-34156	external
https://bugzilla.suse.com/1230253	external
https://www.suse.com/security/cve/CVE-2024-45336	external
https://bugzilla.suse.com/1236045	external
https://bugzilla.suse.com/1236046	external
https://www.suse.com/security/cve/CVE-2024-45341	external
https://bugzilla.suse.com/1236045	external
https://www.suse.com/security/cve/CVE-2025-22866	external
https://bugzilla.suse.com/1236801	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for delve",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2025:3773.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2025:3773.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2025:3773",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_3773.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2025:3773",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-April/001033.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2025:3773",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-April/001033.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-34156 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-34156/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45336 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45336/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45341 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22866 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22866/"
      }
    ],
    "title": "security update for delve",
    "tracking": {
      "current_release_date": "2026-10-11T11:38:05Z",
      "generator": {
        "date": "2025-04-10T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2025:3773",
      "initial_release_date": "2025-04-10T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-04-10T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:53:37Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-11T11:38:05Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.23.6-2.el9_5.noarch",
                "product": {
                  "name": "golang-docs-0:1.23.6-2.el9_5.noarch",
                  "product_id": "golang-docs-0:1.23.6-2.el9_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-docs@1.23.6-2.el9_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.23.6-2.el9_5.noarch",
                "product": {
                  "name": "golang-misc-0:1.23.6-2.el9_5.noarch",
                  "product_id": "golang-misc-0:1.23.6-2.el9_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-misc@1.23.6-2.el9_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.23.6-2.el9_5.noarch",
                "product": {
                  "name": "golang-src-0:1.23.6-2.el9_5.noarch",
                  "product_id": "golang-src-0:1.23.6-2.el9_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-src@1.23.6-2.el9_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.23.6-2.el9_5.noarch",
                "product": {
                  "name": "golang-tests-0:1.23.6-2.el9_5.noarch",
                  "product_id": "golang-tests-0:1.23.6-2.el9_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-tests@1.23.6-2.el9_5?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.24.1-2.el9_5.x86_64",
                "product": {
                  "name": "delve-0:1.24.1-2.el9_5.x86_64",
                  "product_id": "delve-0:1.24.1-2.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/delve@1.24.1-2.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.23.6-2.el9_5.x86_64",
                "product": {
                  "name": "go-toolset-0:1.23.6-2.el9_5.x86_64",
                  "product_id": "go-toolset-0:1.23.6-2.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/go-toolset@1.23.6-2.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.23.6-2.el9_5.x86_64",
                "product": {
                  "name": "golang-0:1.23.6-2.el9_5.x86_64",
                  "product_id": "golang-0:1.23.6-2.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang@1.23.6-2.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.23.6-2.el9_5.x86_64",
                "product": {
                  "name": "golang-bin-0:1.23.6-2.el9_5.x86_64",
                  "product_id": "golang-bin-0:1.23.6-2.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-bin@1.23.6-2.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.23.6-2.el9_5.x86_64",
                "product": {
                  "name": "golang-race-0:1.23.6-2.el9_5.x86_64",
                  "product_id": "golang-race-0:1.23.6-2.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/golang-race@1.23.6-2.el9_5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9.6 EMS",
                "product": {
                  "name": "SUSE Liberty Linux 9.6 EMS",
                  "product_id": "SUSE Liberty Linux 9.6 EMS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.24.1-2.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64"
        },
        "product_reference": "delve-0:1.24.1-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "go-toolset-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "golang-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "golang-bin-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-docs-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-misc-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "golang-race-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-src-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-tests-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.24.1-2.el9_5.x86_64 as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64"
        },
        "product_reference": "delve-0:1.24.1-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "go-toolset-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "golang-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "golang-bin-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-docs-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-misc-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.23.6-2.el9_5.x86_64 as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64"
        },
        "product_reference": "golang-race-0:1.23.6-2.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-src-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.23.6-2.el9_5.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch"
        },
        "product_reference": "golang-tests-0:1.23.6-2.el9_5.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-34156",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-34156"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-34156",
          "url": "https://www.suse.com/security/cve/CVE-2024-34156"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1230253 for CVE-2024-34156",
          "url": "https://bugzilla.suse.com/1230253"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-34156"
    },
    {
      "cve": "CVE-2024-45336",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45336"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45336",
          "url": "https://www.suse.com/security/cve/CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236045 for CVE-2024-45336",
          "url": "https://bugzilla.suse.com/1236045"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236046 for CVE-2024-45336",
          "url": "https://bugzilla.suse.com/1236046"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45336"
    },
    {
      "cve": "CVE-2024-45341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45341",
          "url": "https://www.suse.com/security/cve/CVE-2024-45341"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236045 for CVE-2024-45341",
          "url": "https://bugzilla.suse.com/1236045"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45341"
    },
    {
      "cve": "CVE-2025-22866",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22866"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
          "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
          "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22866",
          "url": "https://www.suse.com/security/cve/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236801 for CVE-2025-22866",
          "url": "https://bugzilla.suse.com/1236801"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9.6 EMS:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9.6 EMS:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9.6 EMS:golang-tests-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:delve-0:1.24.1-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:go-toolset-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-bin-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-docs-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-misc-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-race-0:1.23.6-2.el9_5.x86_64",
            "SUSE Liberty Linux 9:golang-src-0:1.23.6-2.el9_5.noarch",
            "SUSE Liberty Linux 9:golang-tests-0:1.23.6-2.el9_5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22866"
    }
  ]
}

CVE-2024-34156 (GCVE-0-2024-34156)

Vulnerability from cvelistv5 – Published: 2024-09-06 20:42 – Updated: 2024-09-26 15:03

Title

Stack exhaustion in Decoder.Decode in encoding/gob

Summary

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-09 14:04 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/cl/611239
https://go.dev/issue/69139
https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
https://pkg.go.dev/vuln/GO-2024-3106
https://security.netapp.com/advisory/ntap-2024092…

Impacted products

2 products

Vendor	Product	Version
Go standard library	encoding/gob	Affected: 0 , < 1.22.7 (semver) Affected: 1.23.0-0 , < 1.23.1 (semver)
go_standard_library	encoding\/gob	Affected: 0 , < 1.22.7 (semver) Affected: 1.23.0-0 , < 1.23.1 (semver) cpe:2.3:a:go_standard_library:encoding\/gob::::::::

Credits

Md Sakib Anwar of The Ohio State University (anwar.40@osu.edu)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:go_standard_library:encoding\\/gob:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "encoding\\/gob",
            "vendor": "go_standard_library",
            "versions": [
              {
                "lessThan": "1.22.7",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "1.23.1",
                "status": "affected",
                "version": "1.23.0-0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T14:04:16.338747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T14:29:46.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-26T15:03:08.203Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20240926-0004/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/gob",
          "product": "encoding/gob",
          "programRoutines": [
            {
              "name": "Decoder.decIgnoreOpFor"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Decoder.DecodeValue"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.1",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Md Sakib Anwar of The Ohio State University (anwar.40@osu.edu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T20:42:42.661Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/611239"
        },
        {
          "url": "https://go.dev/issue/69139"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-3106"
        }
      ],
      "title": "Stack exhaustion in Decoder.Decode in encoding/gob"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-34156",
    "datePublished": "2024-09-06T20:42:42.661Z",
    "dateReserved": "2024-05-01T18:45:34.846Z",
    "dateUpdated": "2024-09-26T15:03:08.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45336 (GCVE-0-2024-45336)

Vulnerability from cvelistv5 – Published: 2025-01-28 01:03 – Updated: 2025-09-18 18:41

Title

Sensitive headers incorrectly sent after cross-domain redirect in net/http

Summary

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-28 14:56 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

6 references

URL	Tags
https://go.dev/cl/643100
https://go.dev/issue/70530
https://groups.google.com/g/golang-dev/c/CAWXhan3…
https://groups.google.com/g/golang-dev/c/bG8cv1mu…
https://pkg.go.dev/vuln/GO-2025-3420
https://security.netapp.com/advisory/ntap-2025022…

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.22.11 (semver) Affected: 1.23.0-0 , < 1.23.5 (semver) Affected: 1.24.0-0 , < 1.24.0-rc.2 (semver)

Credits

Kyle Seely

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45336",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T14:56:59.058895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T15:16:38.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:31.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "Client.do"
            },
            {
              "name": "Client.makeHeadersCopier"
            },
            {
              "name": "shouldCopyHeaderOnRedirect"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Get"
            },
            {
              "name": "Head"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.5",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.0-rc.2",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Kyle Seely"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-18T18:41:11.116Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/643100"
        },
        {
          "url": "https://go.dev/issue/70530"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3420"
        }
      ],
      "title": "Sensitive headers incorrectly sent after cross-domain redirect in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-45336",
    "datePublished": "2025-01-28T01:03:24.869Z",
    "dateReserved": "2024-08-27T19:41:58.555Z",
    "dateUpdated": "2025-09-18T18:41:11.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45341 (GCVE-0-2024-45341)

Vulnerability from cvelistv5 – Published: 2025-01-28 01:03 – Updated: 2025-02-21 18:03

Title

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

Summary

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-28 14:57 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

6 references

URL	Tags
https://go.dev/cl/643099
https://go.dev/issue/71156
https://groups.google.com/g/golang-dev/c/bG8cv1mu…
https://groups.google.com/g/golang-dev/c/CAWXhan3…
https://pkg.go.dev/vuln/GO-2025-3373
https://security.netapp.com/advisory/ntap-2025022…

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.22.11 (semver) Affected: 1.23.0-0 , < 1.23.5 (semver) Affected: 1.24.0-0 , < 1.24.0-rc.2 (semver)

Credits

Juho Forsén of Mattermost

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45341",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T14:57:00.467281Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T15:16:58.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:33.296Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0004/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "matchURIConstraint"
            },
            {
              "name": "CertPool.AppendCertsFromPEM"
            },
            {
              "name": "Certificate.CheckCRLSignature"
            },
            {
              "name": "Certificate.CheckSignature"
            },
            {
              "name": "Certificate.CheckSignatureFrom"
            },
            {
              "name": "Certificate.CreateCRL"
            },
            {
              "name": "Certificate.Verify"
            },
            {
              "name": "Certificate.VerifyHostname"
            },
            {
              "name": "CertificateRequest.CheckSignature"
            },
            {
              "name": "CreateCertificate"
            },
            {
              "name": "CreateCertificateRequest"
            },
            {
              "name": "CreateRevocationList"
            },
            {
              "name": "DecryptPEMBlock"
            },
            {
              "name": "EncryptPEMBlock"
            },
            {
              "name": "HostnameError.Error"
            },
            {
              "name": "MarshalECPrivateKey"
            },
            {
              "name": "MarshalPKCS1PrivateKey"
            },
            {
              "name": "MarshalPKCS1PublicKey"
            },
            {
              "name": "MarshalPKCS8PrivateKey"
            },
            {
              "name": "MarshalPKIXPublicKey"
            },
            {
              "name": "ParseCRL"
            },
            {
              "name": "ParseCertificate"
            },
            {
              "name": "ParseCertificateRequest"
            },
            {
              "name": "ParseCertificates"
            },
            {
              "name": "ParseDERCRL"
            },
            {
              "name": "ParseECPrivateKey"
            },
            {
              "name": "ParsePKCS1PrivateKey"
            },
            {
              "name": "ParsePKCS1PublicKey"
            },
            {
              "name": "ParsePKCS8PrivateKey"
            },
            {
              "name": "ParsePKIXPublicKey"
            },
            {
              "name": "ParseRevocationList"
            },
            {
              "name": "RevocationList.CheckSignatureFrom"
            },
            {
              "name": "SetFallbackRoots"
            },
            {
              "name": "SystemCertPool"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.5",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.0-rc.2",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Fors\u00e9n of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T19:14:21.421Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/643099"
        },
        {
          "url": "https://go.dev/issue/71156"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3373"
        }
      ],
      "title": "Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-45341",
    "datePublished": "2025-01-28T01:03:24.353Z",
    "dateReserved": "2024-08-27T19:41:58.556Z",
    "dateUpdated": "2025-02-21T18:03:33.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-22866 (GCVE-0-2025-22866)

Vulnerability from cvelistv5 – Published: 2025-02-06 16:54 – Updated: 2025-02-21 18:03

Title

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Summary

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-10 20:40 UTC

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/cl/643735
https://go.dev/issue/71383
https://groups.google.com/g/golang-announce/c/xU1…
https://pkg.go.dev/vuln/GO-2025-3447
https://security.netapp.com/advisory/ntap-2025022…

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/internal/nistec	Affected: 0 , < 1.22.12 (semver) Affected: 1.23.0-0 , < 1.23.6 (semver) Affected: 1.24.0-0 , < 1.24.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T20:40:17.232803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T14:47:25.778Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:36.215Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/internal/nistec",
          "product": "crypto/internal/nistec",
          "programRoutines": [
            {
              "name": "p256NegCond"
            },
            {
              "name": "P256Point.ScalarBaseMult"
            },
            {
              "name": "P256Point.ScalarMult"
            },
            {
              "name": "P256Point.SetBytes"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.6",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.0-rc.3",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T16:54:10.252Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/643735"
        },
        {
          "url": "https://go.dev/issue/71383"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3447"
        }
      ],
      "title": "Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22866",
    "datePublished": "2025-02-06T16:54:10.252Z",
    "dateReserved": "2025-01-08T19:11:42.834Z",
    "dateUpdated": "2025-02-21T18:03:36.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:3773

CVE-2024-34156 (GCVE-0-2024-34156)

CVE-2024-45336 (GCVE-0-2024-45336)

CVE-2024-45341 (GCVE-0-2024-45341)

CVE-2025-22866 (GCVE-0-2025-22866)

Tags

Sightings

Nomenclature

Related by attack behaviour