Medium ALAS2023-2025-913 1 CVE

Moderate: golang security update (Amazon Linux 2023)

Published Mar 26, 2025 · Updated Apr 1, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-22870: NOTE: https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ NOTE: https://github.com/golang/go/issues/71984 NOTE: Fixed by: https://github.com/golang/go/commit/334de7982f8ec959c74470dd709ceedfd6dbd50a (go1.24.1) NOTE: Fixed by: https://github.com/golang/go/commit/25177ecde0922c50753c043579d17828b7ee88e7 (go1.23.7)

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2023	golang	0:1.24.1-1.amzn2023.0.1
Amazon Linux · 2023	golang-bin	0:1.24.1-1.amzn2023.0.1
Amazon Linux · 2023	golang-docs	0:1.24.1-1.amzn2023.0.1
Amazon Linux · 2023	golang-misc	0:1.24.1-1.amzn2023.0.1
Amazon Linux · 2023	golang-shared	0:1.24.1-1.amzn2023.0.1
Amazon Linux · 2023	golang-src	0:1.24.1-1.amzn2023.0.1
Amazon Linux · 2023	golang-tests	0:1.24.1-1.amzn2023.0.1

Vulnerabilities 1

Medium 4.4

CVE-2025-22870 Public exploit

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 12, 2025

References

web
https://alas.aws.amazon.com/cve/html/CVE-2025-22870.html