Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-22873: A directory traversal vulnerability was discovered in the Go programming language's os package in versions prior to 1.24.3. The vulnerability allows improper access to the parent directory of an os.Root by opening a filename ending in "../". When exploited, this vulnerability permits an attacker to open the parent directory of the Root, though it does not allow access to ancestors of the parent or files contained within the parent directory. This issue has been fixed in Go 1.24.3, where Root now correctly returns an error when such access is attempted.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | golang | 0:1.24.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | golang-bin | 0:1.24.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | golang-docs | 0:1.24.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | golang-misc | 0:1.24.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | golang-shared | 0:1.24.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | golang-src | 0:1.24.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | golang-tests | 0:1.24.3-1.amzn2023.0.1 |
Vulnerabilities 1
-
Low 3.8
Improper access to parent directory of root in os
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancesto…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22873.html