File _patchinfo of Package patchinfo.40454

<patchinfo incident="40454">
  <category>security</category>
  <rating>important</rating>
  <packager>msmeissn</packager>
  <summary>Security update for go1.24-openssl</summary>
  <description>
This security update of go1.24-openssl fixes the following issues:

Update to version 1.24.6 cut from the go1.24-fips-release
branch at the revision tagged go1.24.6-1-openssl-fips.
Refs jsc#SLE-18320

* Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil
  salt to be passed as a hash length buffer of zeros.

go1.24.6 (released 2025-08-06) includes security fixes to the
database/sql and os/exec packages, as well as bug fixes to the
runtime.  ( boo#1236217 go1.24 release tracking)

CVE-2025-47906 CVE-2025-47907:

* go#74804 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of "", "." and ".." in some PATH configurations
* go#74833 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan

* go#73800 runtime: RSS seems to have increased in Go 1.24 while the runtime accounting has not
* go#74416 runtime: use-after-free of allpSnapshot in findRunnable
* go#74694 runtime: segfaults in runtime.(*unwinder).next
* go#74760 os/user:nolibgcc: TestGroupIdsTestUser failures

go1.24.5 (released 2025-07-08) includes security fixes to the go
command, as well as bug fixes to the compiler, the linker, the , and
the go command.  ( boo#1236217 go1.24 release tracking)
j
CVE-2025-4674:

* go#74381 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module

* go#73908 runtime: bad frame pointer during panic during duffcopy
* go#74098 cmd/compile: regression on ppc64le bit operations
* go#74113 cmd/go: crash on unknown GOEXPERIMENT during toolchain selection
* go#74290 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning
* go#74294 internal/trace: stress tests triggering suspected deadlock in tracer
* go#74346 runtime: memlock not unlocked in all control flow paths in sysReserveAlignedSbrk
* go#74363 runtime/pprof: crash "cannot read stack of running goroutine" in goroutine profile
* go#74403 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN

go1.24.4 (released 2025-06-05) includes security fixes to the
crypto/x509, net/http, and os packages, as well as bug fixes to
the linker, the go command, and the hash/maphash and os packages.
( boo#1236217 go1.24 release tracking)

CVE-2025-22874 CVE-2025-0913 CVE-2025-4673
* go#73700 go#73702 boo#1244158 security: fix CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation
* go#73720 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows
* go#73906 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect

* go#73570 os: Root.Mkdir creates directories with zero permissions on OpenBSD
* go#73669 hash/maphash: hashing channels with purego impl. of maphash.Comparable panics
* go#73678 runtime/debug: BuildSetting does not document DefaultGODEBUG
* go#73809 cmd/go: add fips140 module selection mechanism
* go#73832 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen
</description>

  <issue id="1236217" tracker="bnc"/>
  <issue id="1244156" tracker="bnc"/>
  <issue id="1244157" tracker="bnc"/>
  <issue id="1244158" tracker="bnc"/>
  <issue id="1246118" tracker="bnc"/>
  <issue id="1247719" tracker="bnc"/>
  <issue id="1247720" tracker="bnc"/>
  <issue id="2025-0913" tracker="cve" />
  <issue id="2025-0913" tracker="cve"/>
  <issue id="2025-22874" tracker="cve" />
  <issue id="2025-22874" tracker="cve"/>
  <issue id="2025-4673" tracker="cve" />
  <issue id="2025-4673" tracker="cve"/>
  <issue id="2025-4674" tracker="cve" />
  <issue id="2025-4674" tracker="cve"/>
  <issue id="2025-47906" tracker="cve" />
  <issue id="2025-47906" tracker="cve"/>
  <issue id="2025-47907" tracker="cve" />
  <issue id="2025-47907" tracker="cve"/>
  <issue id="SLE-18320" tracker="jsc" />
</patchinfo>