Skip to content
OpenAdvisories
Medium ELSA-2025-7466 3 CVEs

Moderate: delve and golang security update (Oracle Linux 10)

Published Jun 27, 2025 · Updated Jun 27, 2025

Ecosystem: Oracle Linux

Summary

delve
[1.24.1-1.0.1]
- Disable DWARF compression which has issues (Alex Burmashev)

[1.24.1-1]
- Update Delve to 1.24.1

[1.22.1-6]
- plans/ci.fmf: Update repo

golang
[1.23.7-1]
- Update to 1.23.7
- golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341)
- golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)
- crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 10 delve 0:1.24.1-1.0.1.el10_0
Oracle Linux · 10 go-toolset 0:1.23.7-1.el10_0
Oracle Linux · 10 golang 0:1.23.7-1.el10_0
Oracle Linux · 10 golang-bin 0:1.23.7-1.el10_0
Oracle Linux · 10 golang-docs 0:1.23.7-1.el10_0
Oracle Linux · 10 golang-misc 0:1.23.7-1.el10_0
Oracle Linux · 10 golang-src 0:1.23.7-1.el10_0
Oracle Linux · 10 golang-tests 0:1.23.7-1.el10_0

Vulnerabilities 3

  • Medium 6.1
    CVE-2024-45336

    Sensitive headers incorrectly sent after cross-domain redirect in net/http

    The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subs…

    Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.1
    CVE-2024-45341

    Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

    A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs whi…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 4.0
    CVE-2025-22866

    Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

    Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is en…

    Go standard library crypto/internal/nistec go zot Debian Ubuntu Alpine Wolfi Go