SB2025112549 - SUSE update for go1.25

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2025-4674)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling multiple VCS configuration metadata in Go toolchain. A remote attacker can trick the victim into directly cloning specially crafted Git or Mercurial repositories and execute arbitrary OS commands on the system.

2) Input validation error (CVE-ID: CVE-2025-47906)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of the PATH environment variable in LookPath. A local user can pass specially crafted strings to the application and execute arbitrary OS commands with elevated privileges. 

3) Race condition (CVE-ID: CVE-2025-47907)

The vulnerability allows an attacker to tamper with the application. 

The vulnerability exists due to a race condition when canceling a DB query. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system. A remote user can overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2025/suse-su-20253681-1/