SB2025061993 - Ubuntu update for golang-1.22
Published: June 19, 2025 Updated: July 18, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2024-45336)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the HTTP client will send Authorization header to a third-party domain after a chain of redirects. A remote attacker can gain unauthorized access to credentials.
2) Input validation error (CVE-ID: CVE-2024-45341)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect handling of URI name constraint in certificate chains. A remote attacker can create a certificate with a URI, which has a IPv6 address with a zone ID, and bypass URI name checks.
The vulnerability affects users of private PKIs which make use of URIs.
3) Memory leak (CVE-ID: CVE-2025-22866)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a small number of bits of secret scalars are leaked on the ppc64le architecture in crypto/internal/nistec. A local user can gain access to potentially sensitive information.
4) Input validation error (CVE-ID: CVE-2025-22870)
The vulnerability allows a remote attacker to alter application's behavior.
The vulnerability exists due to insufficient validation of an IPv6 zone ID as a hostname component, when matching hosts against proxy patterns. For instance the NO_PROXY environment variable is set to "*.example.com", a request to
"[::1%25.example.com]:80` will incorrectly match and not be proxied. A remote attacker can alter application behavior and potentially gain access to sensitive information or functionality.
5) Information disclosure (CVE-ID: CVE-2025-4673)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to sensitive Proxy-Authorization and Proxy-Authenticate headers are not cleared on cross-origin redirect in net/http. A remote attacker can gain access to credentials passed via these headers.
Remediation
Install update from vendor's website.