This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
- Switch from update-alternatives to new method.
- Packaging improvements:
* Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install
of a working go command. Refs boo#1245878 bsc#1264395
* Based on feedback from Factory maintainers restore the original
lifecycle for these files: Each go1.x toolchain shares
ownership of a go and gofmt symlink managed by the alternatives
system (update-alternatives and libalternatives).
This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
- Switch from update-alternatives to new method.
- Packaging improvements:
* Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install
of a working go command. Refs boo#1245878 bsc#1264395
* Based on feedback from Factory maintainers restore the original
lifecycle for these files: Each go1.x toolchain shares
ownership of a go and gofmt symlink managed by the alternatives
system (update-alternatives and libalternatives).
This update for go1.24 fixes the following issues:
Update to version 1.24.13.
Security issues fixed:
- CVE-2025-61732: cmd/go: discrepancy between Go and C/C++ comment parsing allows for C code smuggling (bsc#1257692).
- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does
not account for the expiration of full certificate chain (bsc#1256818).
- CVE-2025-68119: cmd/go: unexpected code execution when invoking toolchain (bsc1256820).
Other updates and bugfixes:
- version update to 1.24.13:
* go#77323 crypto/x509: single-label excluded DNS name constraints incorrectly mat
This update for go1.24 fixes the following issues:
Update to go1.24.12 (released 2026-01-15) (bsc#1236217)
Security fixes:
- CVE-2025-61730: crypto/tls: handshake messages may be processed at the incorrect encryption level (bsc#1256821).
- CVE-2025-68119: cmd/go: unexpected code execution when invoking toolchain (bsc#1256820).
- CVE-2025-61731: cmd/go: bypass of flag sanitization can lead to arbitrary code execution (bsc#1256819).
- CVE-2025-61726: net/http: memory exhaustion in Request.ParseForm (bsc#1256817).
- CVE-2025-61728: archive/zip: denial of service when parsing arbitrary ZIP archives (bsc#1256816).
- CVE-2025-68121: crypto
This update for go1.24 fixes the following issues:
Update to go1.24.11.
Security issues fixed:
- CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames (bsc#1251257).
- CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map (bsc#1251261).
- CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion
(bsc#1251258).
- CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion (bsc#1251259).
- CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints (bsc#1251254).
- CVE-2025-58188: crypto/x509: pan