Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | go-toolset | 0:1.24.4-1.el9_6 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | golang | 0:1.24.4-1.el9_6 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | golang-bin | 0:1.24.4-1.el9_6 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | golang-docs | 0:1.24.4-1.el9_6 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | golang-misc | 0:1.24.4-1.el9_6 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | golang-race | 0:1.24.4-1.el9_6 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | golang-src | 0:1.24.4-1.el9_6 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | golang-tests | 0:1.24.4-1.el9_6 |
Vulnerabilities 2
-
High 7.5
Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
-
Medium 6.8
Sensitive headers not cleared on cross-origin redirect in net/http
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2373305
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10676.json
-
report
https://access.redhat.com/security/cve/CVE-2025-4673
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-4673
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-4673
-
article
https://go.dev/cl/679257
-
article
https://go.dev/issue/73816
-
article
https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
-
advisory
https://pkg.go.dev/vuln/GO-2025-3751
-
report
https://access.redhat.com/security/cve/CVE-2025-22874
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2372320
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-22874
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-22874
-
article
https://go.dev/cl/670375
-
article
https://go.dev/issue/73612
-
advisory
https://pkg.go.dev/vuln/GO-2025-3749