Summary
[1.26.5-1.0.1]
- EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var
[1.26.5-1]
- Update to Go 1.26.5 (fips-1)
[1.25.7-1]
- Update to Go 1.25.7 (fips-1)
[1.25.5-1]
- Update to Go 1.25.5 (fips-1)
[1.25.3-5]
- gating.yaml: Add tier1 s390x tests
[1.25.3-4]
- Cleanup lib/ ownership
- Remove legacy logic forcing lib/ into golang-tests
- Move lib/wasm, lib/fips140, and lib/time to main golang package
- Fixes go_js_wasm_exec availability
[1.25.3-3]
- plans/tier0.fmf: Import plan
[1.25.3-2]
- rpminspect.yaml: Add testdata to annocheck ignore
[1.25.3-1]
- Update to Go 1.25.3
[1.25.1-1]
- Update to Go1.25.1 -Resolves: RHEL-116849
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | go-toolset | 0:1.26.5-1.0.1.el10_2 |
| Oracle Linux · 10 | golang | 0:1.26.5-1.0.1.el10_2 |
| Oracle Linux · 10 | golang-bin | 0:1.26.5-1.0.1.el10_2 |
| Oracle Linux · 10 | golang-docs | 0:1.26.5-1.0.1.el10_2 |
| Oracle Linux · 10 | golang-misc | 0:1.26.5-1.0.1.el10_2 |
| Oracle Linux · 10 | golang-race | 0:1.26.5-1.0.1.el10_2 |
| Oracle Linux · 10 | golang-src | 0:1.26.5-1.0.1.el10_2 |
| Oracle Linux · 10 | golang-tests | 0:1.26.5-1.0.1.el10_2 |
Vulnerabilities 2
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
-
High 7.8
Root escape via symlink plus trailing slash in os
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even whe…