SUSE-CU-2025:6766-1: Security update of bci/golang

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/golang
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2025:6766-1
Container Tags        : bci/golang:1.24-openssl , bci/golang:1.24.6-openssl , bci/golang:1.24.6-openssl-73.16 , bci/golang:latest , bci/golang:stable-openssl , bci/golang:stable-openssl-73.16
Container Release     : 73.16
Severity              : important
Type                  : security
References            : 1236217 1244156 1244157 1244158 1246118 1247719 1247720 CVE-2025-0913
                        CVE-2025-22874 CVE-2025-4673 CVE-2025-4674 CVE-2025-47906 CVE-2025-47907
-----------------------------------------------------------------

The container bci/golang was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:3158-1
Released:    Thu Sep 11 05:04:45 2025
Summary:     Security update for go1.24-openssl
Type:        security
Severity:    important
References:  1236217,1244156,1244157,1244158,1246118,1247719,1247720,CVE-2025-0913,CVE-2025-22874,CVE-2025-4673,CVE-2025-4674,CVE-2025-47906,CVE-2025-47907

This security update of go1.24-openssl fixes the following issues:

Update to version 1.24.6 cut from the go1.24-fips-release
branch at the revision tagged go1.24.6-1-openssl-fips.
Refs jsc#SLE-18320

* Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil
  salt to be passed as a hash length buffer of zeros.

go1.24.6 (released 2025-08-06) includes security fixes to the
database/sql and os/exec packages, as well as bug fixes to the
runtime.  ( boo#1236217 go1.24 release tracking)

CVE-2025-47906 CVE-2025-47907:

* go#74804 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations
* go#74833 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan

* go#73800 runtime: RSS seems to have increased in Go 1.24 while the runtime accounting has not
* go#74416 runtime: use-after-free of allpSnapshot in findRunnable
* go#74694 runtime: segfaults in runtime.(*unwinder).next
* go#74760 os/user:nolibgcc: TestGroupIdsTestUser failures

go1.24.5 (released 2025-07-08) includes security fixes to the go
command, as well as bug fixes to the compiler, the linker, the , and
the go command.  ( boo#1236217 go1.24 release tracking)
j
CVE-2025-4674:

* go#74381 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module

* go#73908 runtime: bad frame pointer during panic during duffcopy
* go#74098 cmd/compile: regression on ppc64le bit operations
* go#74113 cmd/go: crash on unknown GOEXPERIMENT during toolchain selection
* go#74290 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning
* go#74294 internal/trace: stress tests triggering suspected deadlock in tracer
* go#74346 runtime: memlock not unlocked in all control flow paths in sysReserveAlignedSbrk
* go#74363 runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile
* go#74403 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN

go1.24.4 (released 2025-06-05) includes security fixes to the
crypto/x509, net/http, and os packages, as well as bug fixes to
the linker, the go command, and the hash/maphash and os packages.
( boo#1236217 go1.24 release tracking)

CVE-2025-22874 CVE-2025-0913 CVE-2025-4673
* go#73700 go#73702 boo#1244158 security: fix CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation
* go#73720 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows
* go#73906 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect

* go#73570 os: Root.Mkdir creates directories with zero permissions on OpenBSD
* go#73669 hash/maphash: hashing channels with purego impl. of maphash.Comparable panics
* go#73678 runtime/debug: BuildSetting does not document DefaultGODEBUG
* go#73809 cmd/go: add fips140 module selection mechanism
* go#73832 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen


The following package changes have been done:

- go1.24-openssl-doc-1.24.6-150600.13.9.1 updated
- go1.24-openssl-1.24.6-150600.13.9.1 updated
- go1.24-openssl-race-1.24.6-150600.13.9.1 updated