SB2025061002 - SUSE update for go1.24

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Link following (CVE-ID: CVE-2025-0913)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an insecure link following issue within the os.OpenFile(path, os.O_CREATE|O_EXCL) method when handling dangling symlinks on Windows systems. A local user can create a specially crafted symbolic link and write arbitrary files to the system.

2) Path traversal (CVE-ID: CVE-2025-22873)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in file names. A remote attacker can pass a specially crafted filename to the Root.Open() call, e.g. Root.Open("../") and open the parent directory of the Root.

3) Protection Mechanism Failure (CVE-ID: CVE-2025-22874)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error in crypto/x509 when using ExtKeyUsageAny. When calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny it disables policy validation.

This only affected certificate chains which contain policy graphs, which are rather uncommon.

4) Information disclosure (CVE-ID: CVE-2025-4673)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to sensitive Proxy-Authorization and Proxy-Authenticate headers are not cleared on cross-origin redirect in net/http. A remote attacker can gain access to credentials passed via these headers.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2025/suse-su-202501846-1/