Skip to content
OpenAdvisories
Medium ELSA-2025-3772 2 CVEs

Moderate: go-toolset:ol8 security update (Oracle Linux 8)

Published Apr 10, 2025 · Updated Apr 10, 2025

Ecosystem: Oracle Linux

Summary

delve
[1.24.1-1.0.1]
- Disable DWARF compression which has issues (Alex Burmashev)

[1.24.1-1]
- Rebase to 1.24.1
- Skip unsupported tests
- Resolves: RHEL-83451

golang
[1.23.6-1]
- Update to Go 1.23.6
- Resolves: RHEL-83824

[1.22.11-1]
- Rebase to Go1.22.11 to pick up fixes for CVE 2024-45341 and 2024-45336
- Fix test failures with expired certificates
- Resolves: RHEL-73752

[1.22.9-2]
- Remove bundled boringcrypto blob
- Resolves: RHEL-54338

go-toolset
[1.23.6-1]
- Update to Go 1.23.6
- Resolves: RHEL-83824

[1.22.11-1]
- Rebase to Go1.22.11 to pick up fixes for CVEs 2024-45341 and 2024-45336
- Go rebase addresses test failures with expired certificates
- Resolves: RHEL-73752

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 8 delve 0:1.24.1-1.0.1.module+el8.10.0+90545+447bd9e4
Oracle Linux · 8 go-toolset 0:1.23.6-1.module+el8.10.0+90545+447bd9e4
Oracle Linux · 8 golang 0:1.23.6-1.module+el8.10.0+90545+447bd9e4
Oracle Linux · 8 golang-bin 0:1.23.6-1.module+el8.10.0+90545+447bd9e4
Oracle Linux · 8 golang-docs 0:1.23.6-1.module+el8.10.0+90545+447bd9e4
Oracle Linux · 8 golang-misc 0:1.23.6-1.module+el8.10.0+90545+447bd9e4
Oracle Linux · 8 golang-src 0:1.23.6-1.module+el8.10.0+90545+447bd9e4
Oracle Linux · 8 golang-tests 0:1.23.6-1.module+el8.10.0+90545+447bd9e4

Vulnerabilities 2

  • Medium 6.1
    CVE-2024-45336

    Sensitive headers incorrectly sent after cross-domain redirect in net/http

    The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subs…

    Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.1
    CVE-2024-45341

    Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

    A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs whi…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go