Skip to content
OpenAdvisories
Medium · 6.1 CVE-2024-45341 BIT-golang-2024-45341EUVD-2024-41742GHSA-3f6r-qh9c-x6mmGO-2025-3373

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

Published Jan 28, 2025 · Updated Feb 21, 2025 · Assigned by Go

Vendor: Go standard library Product: crypto/x509 Package: aactl Package: actions-runner-controller Package: age Package: amazon-k8s-cni Package: argo-events Package: argo-rollouts Package: argo-workflows Package: atlantis Package: aws-application-networking-k8s Package: aws-efs-csi-driver Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-flb-kinesis Package: aws-load-balancer-controller Package: aws-network-policy-agent Package: aws-privateca-issuer Package: aws-signer-notation-plugin Package: bank-vaults Package: bazelisk Package: bom Package: boring-registry Package: cadvisor Package: capslock Package: cass-operator Package: cert-manager-cmctl Package: cert-manager-webhook-pdns Package: certificate-transparency Package: cfssl Package: chartmuseum Package: checksec Package: cloud-provider-aws-1.31 Package: cloudnative-pg Package: cni-plugins Package: configmap-reload Package: confluent-common-docker Package: conftest Package: containerd-1 Package: containerd-2 Package: controller-gen Package: cortex Package: cosign Package: crane Package: cri-tools Package: croc Package: crossplane-provider-aws Package: crossplane-provider-keycloak Package: crossplane-provider-sql Package: ctop Package: dagdotdev Package: dask-gateway Package: dataplaneapi Package: delve Package: descheduler Package: dex Package: direnv Package: distribution Package: dive Package: docker-compose Package: docker-credential-acr-env Package: docker-credential-ecr-login Package: docker-credential-gcr Package: dockerize Package: elvish Package: emissary Package: esbuild Package: extism Package: falco-exporter Package: falcosidekick Package: ferretdb Package: flannel Package: flannel-cni-plugin Package: fluent-bit-plugin-loki Package: fluent-operator Package: flux Package: flux-helm-controller Package: flux-image-automation-controller Package: flux-kustomize-controller Package: flux-notification-controller Package: flux-source-controller Package: fq Package: frp Package: fscrypt Package: gcsfuse Package: ghaudit Package: git-credential-oauth Package: git-lfs Package: git-sync Package: gitea Package: gitness Package: gitsign Package: gke-gcloud-auth-plugin Package: glow Package: go Package: go-1.20 Package: go-1.21 Package: go-bindata Package: go-licenses Package: go-md2man Package: gobump Package: gobuster Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: golang-go.crypto Package: golangci-lint Package: gops Package: gostatsd Package: gosu Package: govulncheck Package: gptscript Package: grafana-operator Package: grafana-rollout-operator Package: grpc-health-probe Package: grpcurl Package: harbor-cli Package: harbor-registry Package: harbor-scanner-trivy Package: hcloud Package: hello-world-golang Package: helm Package: helm-3 Package: helm-4 Package: helm-docs Package: helm-operator Package: helm-operator-compat Package: helm-push Package: hey Package: hivemind Package: http-echo Package: influx Package: ini-file Package: ip-masq-agent Package: k6 Package: k8s-device-plugin Package: k8sgpt Package: k8ssandra-client Package: k8ssandra-operator Package: k9s Package: kaf Package: kafka_exporter Package: kafka-proxy Package: kaniko Package: kapp Package: kapp-controller Package: karma Package: kbld Package: kiali Package: kind Package: ko Package: kor Package: kpt Package: kserve Package: kserve-agent Package: kserve-agent-compat Package: kserve-manager Package: kserve-manager-compat Package: kserve-modelmesh-serving Package: kserve-modelmesh-serving-compat Package: kserve-qpext Package: kserve-qpext-compat Package: kserve-rest-proxy Package: kserve-router Package: kserve-router-compat Package: kserve-storage-controller Package: kube-bench Package: kube-fluentd-operator Package: kube-logging-operator Package: kube-metrics-adapter Package: kube-rbac-proxy Package: kube-state-metrics Package: kube-vip Package: kubecolor Package: kubectl-1.24 Package: kubectl-1.24-default Package: kubectl-1.27 Package: kubectl-1.27-default Package: kubectl-1.29 Package: kubectl-1.29-default Package: kubectl-1.30 Package: kubectl-1.30-default Package: kubectl-1.31 Package: kubectl-bash-completion-1.24 Package: kubectl-bash-completion-1.27 Package: kubectl-bash-completion-1.29 Package: kubectl-bash-completion-1.30 Package: kubeflow-katib Package: kuberay-operator Package: kuberay-operator-compat Package: kuberlr Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-attacher-compat Package: kubernetes-csi-external-resizer Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard-api Package: kubernetes-dashboard-api-compat Package: kubernetes-dashboard-auth Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-dashboard-web Package: kubernetes-event-exporter Package: kubernetes-ingress-defaultbackend Package: kubernetes-release Package: kubernetes-replicator Package: kubevela Package: kubewatch Package: kustomize Package: kwok Package: kyverno-policy-reporter-kyverno-plugin Package: lazydocker Package: linkerd2-proxy-init Package: litefs Package: litestream Package: local-static-provisioner Package: lvm-driver Package: lvm-driver-compat Package: lxd Package: mage Package: memcached-exporter Package: metacontroller Package: metallb Package: metrics-server Package: minify Package: mkcert Package: mockery Package: mockgen Package: mods Package: msft-golang Package: multus-cni Package: nats Package: neuvector-db-updater Package: neuvector-dbgen Package: neuvector-scanner Package: neuvector-scanner-monitor Package: neuvector-scanner-task Package: neuvector-sigstore-interface Package: newrelic-fluent-bit-output-compat Package: newrelic-nri-statsd Package: nginx-prometheus-exporter Package: nodetaint Package: nri-cassandra Package: nri-couchbase Package: nri-discovery-kubernetes Package: nri-f5 Package: nri-jmx Package: nri-nginx Package: nri-prometheus Package: nri-rabbitmq Package: nsc Package: nuclei Package: oauth2-proxy Package: octo-sts Package: opa-envoy Package: openbao-k8s Package: openfga Package: opensearch-k8s-operator Package: oras Package: osv-scanner Package: overmind Package: paranoia Package: pdfcpu Package: petname Package: php-fpm_exporter Package: pluto Package: podman Package: policy-controller Package: pombump Package: postgres-operator Package: prometheus-adapter Package: prometheus-alertmanager Package: prometheus-operator Package: prometheus-pushgateway Package: promxy Package: protoc-gen-go-grpc Package: q Package: rabbitmq-messaging-topology-operator Package: rancher-loglevel Package: redka Package: regclient Package: render-template Package: restic Package: runc Package: s5cmd Package: sbom-convert Package: sbom-scorecard Package: sbomqs Package: scorecard Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-azure Package: secrets-store-csi-driver-provider-gcp Package: sftpgo Package: sftpgo-plugin-auth Package: sftpgo-plugin-eventsearch Package: sftpgo-plugin-eventstore Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: shfmt Package: skopeo Package: slsa-verifier Package: smarter-device-manager Package: sonobuoy Package: speedtest-go Package: spiffe-helper Package: spire-controller-manager Package: spire-server Package: splunk-otel-collector Package: sql_exporter Package: src-fingerprint Package: stakater-reloader Package: stdlib Package: supercronic Package: swagger Package: temporal Package: temporal-server Package: temporal-ui-server Package: terraform Package: terraform-compat Package: terraform-docs Package: terraform-local-provider-config Package: tflint Package: tfsec Package: thanos Package: thanos-operator Package: timoni Package: trillian Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: trust-manager Package: undock Package: up Package: vault-benchmark Package: vault-k8s Package: velero Package: velero-plugin-for-aws Package: velero-plugin-for-csi Package: velero-plugin-for-microsoft-azure Package: vendir Package: vertical-pod-autoscaler Package: vexctl Package: victoriametrics-operator Package: volume-modifier-for-k8s Package: vt-cli Package: wait-for-port Package: wave Package: wazero Package: wgcf Package: whereabouts Package: wire-go Package: wireguard-go Package: wuzz Package: x509-certificate-exporter Package: xcaddy Package: yace Package: yq Package: ytt Package: yunikorn-web Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

Affected products

VendorProductAffectedFixed
Go standard library crypto/x509 < 1.22.11, 1.23.0-0 – < 1.23.5, 1.24.0-0 – < 1.24.0-rc.2 1.22.11

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 golang-1.24 1.24~rc2-1 —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-go.crypto No fix yet —
Ubuntu 26.04 LTS golang-1.24 No fix yet —
Ubuntu 25.10 golang-1.24 +1 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.22 1.22.2-2ubuntu0.4 USN-7574-1
Ubuntu 22.04 LTS golang-1.17 +5 No fix yet —
Ubuntu 22.04 LTS golang-1.22 1.22.2-2~22.04.3 USN-7574-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 +1 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 +1 No fix yet —
Ubuntu Pro 18.04 LTS lxd +4 No fix yet —
Ubuntu Pro 16.04 LTS lxd +3 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 delve 1.24.1-1.el10_0 RHSA-2025:7466
RHEL 10 golang +6 1.23.7-1.el10_0 RHSA-2025:7466
RHEL 9 delve 1.24.1-2.el9_5 RHSA-2025:3773
RHEL 9 git-lfs 3.7.1-4.el9_8 RHSA-2026:19350
RHEL 9 golang +7 1.23.6-2.el9_5 RHSA-2025:3773
RHEL 8 delve 1.24.1-1.module+el8.10.0+22945+b2c96a17 RHSA-2025:3772
RHEL 8 golang +6 1.23.6-1.module+el8.10.0+22945+b2c96a17 RHSA-2025:3772

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 delve 1.24.1-1.el10_0 ALSA-2025:7466
AlmaLinux 10 golang +6 1.23.7-1.el10_0.alma.1 ALSA-2025:7466
AlmaLinux 9 git-lfs 3.7.1-4.el9_8 ALSA-2026:19350
AlmaLinux 8 delve 1.24.1-1.module_el8.10.0+3977+66935a26 ALSA-2025:3772
AlmaLinux 8 golang +6 1.23.6-1.module_el8.10.0+3977+66935a26 ALSA-2025:3772

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 delve 1.24.1-1.el10_0 RLSA-2025:7466
Rocky Linux 10 golang 1.23.7-1.el10_0 RLSA-2025:7466
Rocky Linux 9 delve 1.24.1-2.el9_6 RLSA-2025:3773
Rocky Linux 9 golang 1.23.6-2.el9_6 RLSA-2025:3773
Rocky Linux 8 delve 1.24.1-1.module+el8.10.0+1951+c74bd827 RLSA-2025:3772
Rocky Linux 8 golang +1 1.23.6-1.module+el8.10.0+1951+c74bd827 RLSA-2025:3772

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.23-openssl 1.23.12-150600.13.9.1 SUSE-SU-2025:03159-1
SLES 15 SP6 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLES 15 SP6 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLES 15 SP6 go1.23-openssl 1.23.12-150600.13.9.1 SUSE-SU-2025:03159-1
SLES 15 SP6 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLES 15 SP6 govulncheck-vulndb 0.0.20250128T150132-150000.1.29.1 SUSE-SU-2025:0429-1, SUSE-SU-2025:0297-1
SLES 15 SP5 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLES 15 SP5 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLES 15 SP5 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLES 15 SP5 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLES 15 SP5 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLES 15 SP4 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLES 15 SP4 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLES 15 SP4 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLES 15 SP4 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLES 15 SP4 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLES 15 SP3 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLES 15 SP3 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLES 15 SP3 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLES 15 SP3 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLES 15 SP3 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLES for SAP 15 SP5 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLES for SAP 15 SP5 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLES for SAP 15 SP5 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLES for SAP 15 SP5 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLES for SAP 15 SP4 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLES for SAP 15 SP4 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLES for SAP 15 SP4 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLES for SAP 15 SP4 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLES for SAP 15 SP4 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLES for SAP 15 SP3 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLES for SAP 15 SP3 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLES for SAP 15 SP3 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLES for SAP 15 SP3 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLES for SAP 15 SP3 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLE HPC 15 SP5 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLE HPC 15 SP5 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLE HPC 15 SP5 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLE HPC 15 SP5 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLE HPC 15 SP5 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLE HPC 15 SP4 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLE HPC 15 SP4 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLE HPC 15 SP4 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLE HPC 15 SP4 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLE HPC 15 SP4 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SLE HPC 15 SP3 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SLE HPC 15 SP3 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SLE HPC 15 SP3 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SLE HPC 15 SP3 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SLE HPC 15 SP3 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
SUSE Enterprise Storage 7.1 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
SUSE Enterprise Storage 7.1 go1.22-openssl 1.22.12-150000.1.12.1 SUSE-SU-2025:1555-1
SUSE Enterprise Storage 7.1 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
SUSE Enterprise Storage 7.1 go1.23-openssl 1.23.9-150000.1.9.1 SUSE-SU-2025:01731-1
SUSE Enterprise Storage 7.1 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.22 1.22.11-1.1 openSUSE-SU-2025:14694-1
openSUSE Tumbleweed go1.23 1.23.5-1.1 openSUSE-SU-2025:14695-1
openSUSE Tumbleweed go1.24 1.24rc2-1.1 openSUSE-SU-2025:14693-1
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250128T150132-1.1 openSUSE-SU-2025:14710-1
openSUSE Tumbleweed opentofu 1.9.1-1.1 openSUSE-SU-2025:15030-1
openSUSE Leap 15.6 go1.22 1.22.11-150000.1.39.1 SUSE-SU-2025:0281-1
openSUSE Leap 15.6 go1.23 1.23.5-150000.1.18.1 SUSE-SU-2025:0280-1
openSUSE Leap 15.6 go1.23-openssl 1.23.12-150600.13.9.1 SUSE-SU-2025:03159-1
openSUSE Leap 15.6 go1.24 1.24rc2-150000.1.3.1 SUSE-SU-2025:0285-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20250128T150132-150000.1.29.1 SUSE-SU-2025:0429-1, SUSE-SU-2025:0297-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.23.5-r0 —
Alpine v3.23 go 1.23.5-r0 —
Alpine v3.22 go 1.23.5-r0 —
Alpine v3.21 go 1.23.5-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +6 1.24.0-1.amzn2023.0.1 ALAS2023-2025-878
Amazon Linux 2 golang +6 1.23.7-1.amzn2.0.1 ALAS2-2025-2795

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —
Azure Linux 2 (CBL-Mariner) golang 1.18.8-5 —
Azure Linux 2 (CBL-Mariner) msft-golang 1.23.3-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 delve 1.24.1-1.0.1.el10_0 ELSA-2025-7466
Oracle Linux 10 golang +6 1.23.7-1.el10_0 ELSA-2025-7466
Oracle Linux 8 delve 1.24.1-1.0.1.module+el8.10.0+90545+447bd9e4 ELSA-2025-3772
Oracle Linux 8 golang +6 1.23.6-1.module+el8.10.0+90545+447bd9e4 ELSA-2025-3772

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r22 —
Wolfi rolling actions-runner-controller 0.10.1-r2 —
Wolfi rolling age 1.2.1-r1 —
Wolfi rolling amazon-k8s-cni 1.19.2-r1 —
Wolfi rolling argo-events 1.9.5-r1 —
Wolfi rolling argo-rollouts 1.7.2-r4 —
Wolfi rolling argo-workflows 3.6.3-r1 —
Wolfi rolling atlantis 0.32.0-r1 —
Wolfi rolling aws-application-networking-k8s 1.1.0-r2 —
Wolfi rolling aws-efs-csi-driver 2.1.4-r1 —
Wolfi rolling aws-flb-cloudwatch 1.9.4-r14 —
Wolfi rolling aws-flb-firehose 1.7.2-r14 —
Wolfi rolling aws-flb-kinesis 1.10.2-r15 —
Wolfi rolling aws-network-policy-agent 1.1.6-r1 —
Wolfi rolling aws-signer-notation-plugin 1.0.350-r1 —
Wolfi rolling bank-vaults 1.20.4-r23 —
Wolfi rolling bazelisk +1 1.25.0-r1 —
Wolfi rolling bom 0.6.0-r15 —
Wolfi rolling boring-registry 0.15.5-r1 —
Wolfi rolling cadvisor 0.51.0-r3 —
Wolfi rolling capslock 0.2.7-r1 —
Wolfi rolling cass-operator 1.23.0-r2 —
Wolfi rolling cert-manager-cmctl 2.1.1-r4 —
Wolfi rolling cert-manager-webhook-pdns 2.5.1-r10 —
Wolfi rolling certificate-transparency 1.3.1-r1 —
Wolfi rolling cfssl 1.6.5-r14 —
Wolfi rolling chartmuseum 0.16.2-r10 —
Wolfi rolling checksec 3.0.0-r1 —
Wolfi rolling cloud-provider-aws-1.31 1.31.4-r3 —
Wolfi rolling configmap-reload 0.14.0-r2 —
Wolfi rolling confluent-common-docker 7.6.0-r10 —
Wolfi rolling conftest 0.56.0-r3 —
Wolfi rolling containerd-1 1.7.25-r1 —
Wolfi rolling containerd-2 2.0.2-r1 —
Wolfi rolling controller-gen 0.17.1-r1 —
Wolfi rolling cortex 1.18.1-r4 —
Wolfi rolling cosign 2.4.1-r5 —
Wolfi rolling crane 0.20.3-r1 —
Wolfi rolling cri-tools 1.32.0-r3 —
Wolfi rolling croc 10.2.1-r1 —
Wolfi rolling crossplane-provider-aws 1.19.0-r1 —
Wolfi rolling crossplane-provider-keycloak 1.7.0-r4 —
Wolfi rolling crossplane-provider-sql 0.11.0-r1 —
Wolfi rolling ctop 0.7.7-r21 —
Wolfi rolling dagdotdev 0.0.12-r2 —
Wolfi rolling dask-gateway 2024.1.0-r14 —
Wolfi rolling dataplaneapi 3.0.4-r1 —
Wolfi rolling delve 1.24.0-r1 —
Wolfi rolling descheduler 0.32.1-r1 —
Wolfi rolling dex 2.41.1-r4 —
Wolfi rolling direnv 2.35.0-r1 —
Wolfi rolling distribution 3.0.0-r5 —
Wolfi rolling dive 0.12.0-r14 —
Wolfi rolling docker-compose 2.32.4-r1 —
Wolfi rolling docker-credential-acr-env 0.7.0-r17 —
Wolfi rolling docker-credential-gcr 2.1.26-r2 —
Wolfi rolling dockerize 0.9.2-r1 —
Wolfi rolling elvish 0.21.0-r1 —
Wolfi rolling emissary 3.9.1-r9 —
Wolfi rolling esbuild 0.24.2-r1 —
Wolfi rolling extism +2 1.6.2-r1 —
Wolfi rolling falco-exporter 0.8.7-r2 —
Wolfi rolling falcosidekick 2.30.0-r3 —
Wolfi rolling ferretdb 1.24.0-r5 —
Wolfi rolling flannel 0.26.3-r1 —
Wolfi rolling flannel-cni-plugin 1.6.0-r1 —
Wolfi rolling fluent-bit-plugin-loki 3.3.2-r2 —
Wolfi rolling fluent-operator 3.2.0-r6 —
Wolfi rolling flux +1 2.4.0-r5 —
Wolfi rolling flux-helm-controller 1.1.0-r4 —
Wolfi rolling flux-image-automation-controller 0.39.0-r6 —
Wolfi rolling flux-kustomize-controller 1.4.0-r5 —
Wolfi rolling flux-notification-controller 1.4.0-r4 —
Wolfi rolling flux-source-controller 1.4.1-r8 —
Wolfi rolling fq 0.13.0-r3 —
Wolfi rolling frp 0.61.1-r2 —
Wolfi rolling fscrypt 0.3.5-r4 —
Wolfi rolling gcsfuse 1.4.2-r14 —
Wolfi rolling ghaudit 0.4.0-r8 —
Wolfi rolling git-credential-oauth 0.14.0-r1 —
Wolfi rolling git-lfs 3.6.1-r1 —
Wolfi rolling git-sync 4.4.0-r1 —
Wolfi rolling gitea 1.23.1-r1 —
Wolfi rolling gitness 3.1.1-r1 —
Wolfi rolling gitsign 0.12.0-r2 —
Wolfi rolling gke-gcloud-auth-plugin 0.1.0-r1 —
Wolfi rolling glow 2.0.0-r4 —
Wolfi rolling go-bindata 3.1.3-r24 —
Wolfi rolling go-licenses 1.6.0-r21 —
Wolfi rolling go-md2man 2.0.6-r2 —
Wolfi rolling gobump +1 0.9.0-r1 —
Wolfi rolling gobuster 3.6.0-r17 —
Wolfi rolling golangci-lint 1.63.4-r1 —
Wolfi rolling gops 0.3.28-r14 —
Wolfi rolling gostatsd 28.3.0-r9 —
Wolfi rolling gosu 1.17-r10 —
Wolfi rolling govulncheck 1.0.2-r8 —
Wolfi rolling gptscript 0.9.5-r5 —
Wolfi rolling grafana-operator 5.16.0-r1 —
Wolfi rolling grafana-rollout-operator 0.23.0-r1 —
Wolfi rolling grpc-health-probe 0.4.37-r1 —
Wolfi rolling grpcurl 1.9.2-r3 —
Wolfi rolling harbor-cli 0.0.2-r2 —
Wolfi rolling harbor-registry 3.0.0_alpha1-r24 —
Wolfi rolling harbor-scanner-trivy 0.32.3-r2 —
Wolfi rolling hcloud 1.50.0-r1 —
Wolfi rolling hello-world-golang 1.3-r7 —
Wolfi rolling helm 3.17.0-r1 —
Wolfi rolling helm-3 3.19.2-r1 —
Wolfi rolling helm-4 4.0.1-r1 —
Wolfi rolling helm-docs 1.14.2-r4 —
Wolfi rolling helm-operator +1 1.39.1-r1 —
Wolfi rolling helm-push 0.10.4-r18 —
Wolfi rolling hey 0.1.4-r18 —
Wolfi rolling hivemind 1.1.0-r5 —
Wolfi rolling http-echo 1.0.0-r11 —
Wolfi rolling influx 2.7.5-r5 —
Wolfi rolling ini-file 1.4.7-r1 —
Wolfi rolling ip-masq-agent 2.12.0-r3 —
Wolfi rolling k6 0.56.0-r1 —
Wolfi rolling k8s-device-plugin 0.17.0-r4 —
Wolfi rolling k8sgpt 0.3.48-r4 —
Wolfi rolling k8ssandra-client 0.6.0-r3 —
Wolfi rolling k8ssandra-operator 1.20.2-r2 —
Wolfi rolling k9s 0.32.7-r4 —
Wolfi rolling kaf 0.2.8-r9 —
Wolfi rolling kafka-proxy 0.3.12-r3 —
Wolfi rolling kafka_exporter 1.8.0-r5 —
Wolfi rolling kaniko 1.23.2-r9 —
Wolfi rolling kapp 0.64.0-r2 —
Wolfi rolling karma 0.120-r2 —
Wolfi rolling kbld 0.45.0-r2 —
Wolfi rolling kiali 2.4.0-r1 —
Wolfi rolling kind 0.26.0-r1 —
Wolfi rolling ko 0.17.1-r4 —
Wolfi rolling kor 0.5.8-r1 —
Wolfi rolling kpt 1.0.0_beta55-r2 —
Wolfi rolling kserve +9 0.14.1-r2 —
Wolfi rolling kserve-modelmesh-serving +1 0.12.0-r5 —
Wolfi rolling kserve-rest-proxy 0.12.0-r3 —
Wolfi rolling kube-bench 0.10.0-r1 —
Wolfi rolling kube-fluentd-operator 1.18.2-r21 —
Wolfi rolling kube-logging-operator 5.0.1-r1 —
Wolfi rolling kube-metrics-adapter 0.2.3-r5 —
Wolfi rolling kube-rbac-proxy 0.18.2-r3 —
Wolfi rolling kube-state-metrics 2.14.0-r3 —
Wolfi rolling kube-vip 0.8.9-r1 —
Wolfi rolling kubectl-1.29 +2 1.29.13-r1 —
Wolfi rolling kubectl-1.30 +2 1.30.9-r1 —
Wolfi rolling kubectl-1.31 1.31.14-r0 —
Wolfi rolling kubeflow-katib 0.17.0-r9 —
Wolfi rolling kuberay-operator +1 1.2.2-r2 —
Wolfi rolling kuberlr 0.5.2-r2 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.15.0-r4 —
Wolfi rolling kubernetes-csi-external-attacher +1 4.8.0-r2 —
Wolfi rolling kubernetes-csi-external-resizer 1.13.1-r1 —
Wolfi rolling kubernetes-csi-livenessprobe 2.15.0-r2 —
Wolfi rolling kubernetes-dashboard-api +1 1.10.2-r1 —
Wolfi rolling kubernetes-dashboard-auth 1.2.3-r1 —
Wolfi rolling kubernetes-dashboard-web 1.6.1-r1 —
Wolfi rolling kubernetes-event-exporter 1.7-r15 —
Wolfi rolling kubernetes-ingress-defaultbackend 1.33.0-r1 —
Wolfi rolling kubernetes-release 0.17.12-r1 —
Wolfi rolling kubernetes-replicator +1 2.11.0-r2 —
Wolfi rolling kubevela 1.9.13-r7 —
Wolfi rolling kubewatch 2.9.0-r3 —
Wolfi rolling kustomize 5.6.0-r1 —
Wolfi rolling kwok 0.6.1-r3 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r3 —
Wolfi rolling lazydocker 0.24.1-r1 —
Wolfi rolling linkerd2-proxy-init 2.4.2-r1 —
Wolfi rolling litefs 0.5.11-r10 —
Wolfi rolling litestream 0.3.13-r9 —
Wolfi rolling local-static-provisioner 2.7.0-r11 —
Wolfi rolling lvm-driver +1 1.6.2-r3 —
Wolfi rolling mage 1.15.0-r11 —
Wolfi rolling memcached-exporter 0.15.0-r4 —
Wolfi rolling metacontroller 4.11.22-r1 —
Wolfi rolling metallb 0.14.9-r3 —
Wolfi rolling metrics-server 0.7.2-r4 —
Wolfi rolling minify 2.21.3-r1 —
Wolfi rolling mkcert 1.4.4-r8 —
Wolfi rolling mockery 2.51.1-r0 —
Wolfi rolling mockgen +1 0.5.0-r1 —
Wolfi rolling mods 1.7.0-r1 —
Wolfi rolling multus-cni 4.1.4-r2 —
Wolfi rolling nats +1 0.1.6-r1 —
Wolfi rolling neuvector-dbgen +1 0_git20240423-r4 —
Wolfi rolling neuvector-scanner +2 3.788-r0 —
Wolfi rolling neuvector-sigstore-interface 0_git20240801-r5 —
Wolfi rolling newrelic-nri-statsd 2.10.0-r2 —
Wolfi rolling nginx-prometheus-exporter 1.4.1-r1 —
Wolfi rolling nodetaint 0.0.4-r26 —
Wolfi rolling nri-couchbase 2.7.2-r1 —
Wolfi rolling nri-discovery-kubernetes 1.10.0-r1 —
Wolfi rolling nri-f5 2.8.1-r2 —
Wolfi rolling nri-jmx 3.7.2-r1 —
Wolfi rolling nri-nginx 3.5.1-r1 —
Wolfi rolling nri-prometheus 2.23.0-r1 —
Wolfi rolling nri-rabbitmq +1 2.14.1-r1 —
Wolfi rolling nsc 2.10.2-r1 —
Wolfi rolling nuclei 3.3.8-r1 —
Wolfi rolling oauth2-proxy 7.8.1-r1 —
Wolfi rolling octo-sts 0.4.2-r5 —
Wolfi rolling openbao-k8s +1 1.4.0-r3 —
Wolfi rolling openfga 1.8.4-r1 —
Wolfi rolling opensearch-k8s-operator 2.7.0-r2 —
Wolfi rolling oras +1 1.2.2-r1 —
Wolfi rolling osv-scanner 1.9.2-r2 —
Wolfi rolling overmind 2.5.1-r6 —
Wolfi rolling paranoia 0.2.1-r20 —
Wolfi rolling pdfcpu 0.9.1-r1 —
Wolfi rolling petname 2.11-r11 —
Wolfi rolling php-fpm_exporter 2.2.0-r11 —
Wolfi rolling pluto 5.21.1-r1 —
Wolfi rolling podman 5.3.2-r0 —
Wolfi rolling policy-controller 0.12.0-r1 —
Wolfi rolling pombump 0.0.13-r3 —
Wolfi rolling postgres-operator 1.14.0-r1 —
Wolfi rolling prometheus-adapter 0.12.0-r6 —
Wolfi rolling prometheus-alertmanager 0.28.0-r1 —
Wolfi rolling prometheus-operator 0.79.2-r2 —
Wolfi rolling prometheus-pushgateway 1.11.0-r1 —
Wolfi rolling promxy 0.0.91-r4 —
Wolfi rolling protoc-gen-go-grpc 1.5.1-r2 —
Wolfi rolling q 0.19.2-r12 —
Wolfi rolling rabbitmq-messaging-topology-operator 1.15.0-r3 —
Wolfi rolling redka 0.5.3-r1 —
Wolfi rolling regclient 0.8.0-r2 —
Wolfi rolling render-template 1.0.7-r3 —
Wolfi rolling restic 0.17.3-r3 —
Wolfi rolling runc 1.2.4-r1 —
Wolfi rolling s5cmd 2.3.0-r1 —
Wolfi rolling sbom-convert 0.0.6-r1 —
Wolfi rolling sbom-scorecard 0.0.7-r17 —
Wolfi rolling sbomqs +1 1.0.0-r1 —
Wolfi rolling scorecard 5.0.0-r6 —
Wolfi rolling secrets-store-csi-driver-provider-aws 0.3.10-r2 —
Wolfi rolling secrets-store-csi-driver-provider-gcp 1.7.0-r2 —
Wolfi rolling sftpgo 2.6.4-r2 —
Wolfi rolling sftpgo-plugin-auth 1.0.10-r3 —
Wolfi rolling sftpgo-plugin-eventstore +1 1.0.19-r3 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.9-r2 —
Wolfi rolling sftpgo-plugin-kms 1.0.14-r3 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.13-r3 —
Wolfi rolling shfmt 3.10.0-r2 —
Wolfi rolling skopeo 1.17.0-r3 —
Wolfi rolling slsa-verifier 2.6.0-r8 —
Wolfi rolling smarter-device-manager 1.20.11-r13 —
Wolfi rolling sonobuoy 0.57.2-r4 —
Wolfi rolling speedtest-go 1.7.10-r1 —
Wolfi rolling spiffe-helper +1 0.9.0-r3 —
Wolfi rolling spire-controller-manager 0.6.0-r1 —
Wolfi rolling spire-server 1.11.1-r2 —
Wolfi rolling splunk-otel-collector 0.117.0-r0 —
Wolfi rolling sql_exporter 0.17.0-r1 —
Wolfi rolling src-fingerprint 0.19.0-r22 —
Wolfi rolling stakater-reloader 1.2.1-r2 —
Wolfi rolling supercronic 0.2.33-r1 —
Wolfi rolling swagger 0.31.0-r5 —
Wolfi rolling temporal 1.2.0-r1 —
Wolfi rolling temporal-server 1.26.2-r1 —
Wolfi rolling temporal-ui-server 2.34.0-r1 —
Wolfi rolling terraform +2 1.5.7-r36 —
Wolfi rolling terraform-docs 0.19.0-r3 —
Wolfi rolling tflint +1 0.55.0-r1 —
Wolfi rolling tfsec 1.28.13-r1 —
Wolfi rolling thanos 0.37.2-r3 —
Wolfi rolling thanos-operator 0.3.7-r24 —
Wolfi rolling timoni 0.23.0-r4 —
Wolfi rolling trillian 1.7.1-r1 —
Wolfi rolling trino +58 469-r2 —
Wolfi rolling trust-manager 0.15.0-r1 —
Wolfi rolling up +8 No fix yet —
Wolfi rolling vault-benchmark 0.3.0-r3 —
Wolfi rolling vault-k8s 1.6.1-r2 —
Wolfi rolling velero 1.15.2-r1 —
Wolfi rolling velero-plugin-for-aws +1 1.11.1-r1 —
Wolfi rolling velero-plugin-for-csi 0.7.1-r9 —
Wolfi rolling vendir 0.43.0-r1 —
Wolfi rolling vertical-pod-autoscaler 1.3.0-r0 —
Wolfi rolling vexctl 0.3.0-r4 —
Wolfi rolling victoriametrics-operator 0.52.0-r0 —
Wolfi rolling volume-modifier-for-k8s 0.5.1-r1 —
Wolfi rolling vt-cli 1.0.1-r4 —
Wolfi rolling wait-for-port 1.0.8-r3 —
Wolfi rolling wave 0.10.0-r2 —
Wolfi rolling wazero 1.8.2-r1 —
Wolfi rolling wgcf 2.2.24-r1 —
Wolfi rolling whereabouts 0.8.0-r3 —
Wolfi rolling wire-go 0.6.0-r8 —
Wolfi rolling wireguard-go 0.0.20230223-r19 —
Wolfi rolling wuzz 0.5.0-r4 —
Wolfi rolling x509-certificate-exporter 3.18.1-r1 —
Wolfi rolling xcaddy 0.4.4-r1 —
Wolfi rolling yace 0.62.1-r2 —
Wolfi rolling yq 4.45.1-r1 —
Wolfi rolling ytt 0.51.1-r1 —
Wolfi rolling yunikorn-web 1.6.1-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.22.11 · >= 1.23.0-0, < 1.23.5 · >= 1.24.0-0, < 1.24.0-rc.2 1.22.11, 1.23.5, 1.24.0-rc.2 GO-2025-3373

Advisories 29

References