Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

SUSE: 2025:0431-1 moderate: go1.24 code execution and timing issues

suse
Calendar Grey February 11, 2025
Dist Suse Esm H88
The latest security patch for go1.24 resolves significant vulnerabilities in SUSE that impact multiple products. Ensure you apply the suggested updates promptly.
* bsc#1236217 * bsc#1236801 * bsc#1236839 Cross-References:

Summary

## This update for go1.24 fixes the following issues: * CVE-2025-22866: Fixed timing sidechannel for P-256 on ppc64le (bsc#1236801). * CVE-2025-22867: Fixed arbitrary code execution during build on darwin (bsc#1236839). Other fixes: * go1.2r42 release tracking (bsc#1236217) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-431=1 * Development Tools Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2025-431=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * go1.24-doc-1.24rc3-150000.1.6.1 * go1.24-race-1.24rc3-150000.1.6.1

Topics%20covered

Topics Covered

security advisory moderate arbitrary code execution development tools SUSE timing sidechannel go1.24

References

* bsc#1236217

* bsc#1236801

* bsc#1236839

Cross-

* CVE-2025-22866

* CVE-2025-22867

CVSS scores:

* CVE-2025-22866 ( SUSE ): 6.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

* CVE-2025-22866 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

* CVE-2025-22866 ( NVD ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2025-22867 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

* CVE-2025-22867 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products:

* Development Tools Module 15-SP6

* openSUSE Leap 15.6

* SUSE Linux Enterprise Desktop 15 SP6

* SUSE Linux Enterprise Real Time 15 SP6

* SUSE Linux Enterprise Server 15 SP6

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

Announcement ID: SUSE-SU-2025:0431-1
Release Date: 2025-02-11T14:13:49Z
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate arbitrary code execution development tools SUSE timing sidechannel go1.24

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here