p PatchFirst

openSUSE-SU-2026:21254-1

openSUSE-SU-2026:21254-1 · Security update for go1.26-openssl

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

This update for go1.26-openssl fixes the following issues: Update to go1.26.4 (bsc#1255111). Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653). - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654). - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655). - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450). - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656). - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657). - CVE-2026-32282: os: `Root.Chmod` can follow symlinks out of the root on Linux (bsc#1261658). - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock (bsc#1261659). - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660). - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661). - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains (bsc#1261662). - CVE-2026-33811: net: crash when handling long `CNAME` response (bsc#1264508). - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad `SETTINGS_MAX_FRAME_SIZE` (bsc#1264506). - CVE-2026-39817: cmd/go: `go tool pack` does not sanitize output paths (bsc#1264505). - CVE-2026-39819: cmd/go: `go bug` follows symlinks in predictable temporary filenames (bsc#1264504). - CVE-2026-39820: net/mail: quadratic string concatentation in `consumeComment` (bsc#1264503). - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509). - CVE-2026-39825: net/http/httputil: `ReverseProxy` forwards queries with more than `urlmaxqueryparams` parameters (bsc#1264500). - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507). - CVE-2026-39836: net: panic in `Dial` and `LookupPort` when handling `NUL` byte on Windows (bsc#1264501). - CVE-2026-42499: net/mail: quadratic string concatenation in `consumePhrase` (bsc#1264502). - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499). - CVE-2026-42504: mime: quadratic complexity in `WordDecoder.DecodeHeader` (bsc#1267442). - CVE-2026-42507: net/textproto: arbitrary input is included in errors without any escaping (bsc#1267444). Other updates and security fixes: - Go packages miss `binutils-gold` dependency (bsc#1170826). - Drop subpackage `go1.x-libstd` `std` library `.so` refs (jsc#PED-1962). - Use `libalternatives` only on `suse_version >= 1610` and keep `update-alternatives` support for older distributions. - Drop the `update-alternatives` migration path for `libalternatives` builds. - Enable `libalternatives` for SLE16.1 and Tumbleweed (bsc#1245878). - Drop go1.26 dependency on `update-alternatives` (bsc#1264395) - Update to version 1.26.3 cut from the `go1.25-fips-release` branch at the revision tagged `go1.26.3-1-openssl-fips` (jsc#SLE-18320).

Corrección disponible

Publicación
Actualización

Pila tecnológica: system

Productos y versiones afectados

  • go1.26-openssl openSUSE:Leap 16.0

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.26.4-160000.1.1

    Actualiza a 1.26.4-160000.1.1

Fuentes originales

Comprueba tu servidor →