Red Hat Security Advisory: golang security update

Fixed packages 8

Vulnerabilities 2

• High 7.5
  CVE-2025-22874

  Usage of ExtKeyUsageAny disables policy validation in crypto/x509

  Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 11, 2025
• Medium 6.8
  CVE-2025-4673

  Sensitive headers not cleared on cross-origin redirect in net/http

  Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

  Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373305
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10677.json
• report
  https://access.redhat.com/security/cve/CVE-2025-4673
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-4673
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-4673
• article
  https://go.dev/cl/679257
• article
  https://go.dev/issue/73816
• article
  https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
• advisory
  https://pkg.go.dev/vuln/GO-2025-3751
• report
  https://access.redhat.com/security/cve/CVE-2025-22874
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2372320
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22874
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22874
• article
  https://go.dev/cl/670375
• article
  https://go.dev/issue/73612
• advisory
  https://pkg.go.dev/vuln/GO-2025-3749