Skip to content
OpenAdvisories
Medium ALAS2023-2025-977 1 CVE

Moderate: golang security update (Amazon Linux 2023)

Published May 21, 2025 · Updated Jun 2, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-22873: A directory traversal vulnerability was discovered in the Go programming language's os package in versions prior to 1.24.3. The vulnerability allows improper access to the parent directory of an os.Root by opening a filename ending in "../". When exploited, this vulnerability permits an attacker to open the parent directory of the Root, though it does not allow access to ancestors of the parent or files contained within the parent directory. This issue has been fixed in Go 1.24.3, where Root now correctly returns an error when such access is attempted.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 golang 0:1.24.3-1.amzn2023.0.1
Amazon Linux · 2023 golang-bin 0:1.24.3-1.amzn2023.0.1
Amazon Linux · 2023 golang-docs 0:1.24.3-1.amzn2023.0.1
Amazon Linux · 2023 golang-misc 0:1.24.3-1.amzn2023.0.1
Amazon Linux · 2023 golang-shared 0:1.24.3-1.amzn2023.0.1
Amazon Linux · 2023 golang-src 0:1.24.3-1.amzn2023.0.1
Amazon Linux · 2023 golang-tests 0:1.24.3-1.amzn2023.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22873.html