Debian Linux - golang-1.15 - None

golang-1.19 - None

golang-1.23 - None

golang-1.24 - None

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01846-1 advisory.

    go1.24.4 (released 2025-06-05) includes security fixes to the     crypto/x509, net/http, and os packages, as well as bug fixes to     the linker, the go command, and the hash/maphash and os packages.
    ( bsc#1236217 go1.24 release tracking CVE-2025-22874 CVE-2025-0913 CVE-2025-4673)

    * CVE-2025-22874: crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158)
    * CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)
    * CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)
    * os: Root.Mkdir creates directories with zero permissions on OpenBSD
    * hash/maphash: hashing channels with purego impl. of maphash.Comparable panics
    * runtime/debug: BuildSetting does not document DefaultGODEBUG
    * cmd/go: add fips140 module selection mechanism
    * cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen
    * CVE-2025-22873: os: Root permits access to parent directory

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-977 advisory.

    A directory traversal vulnerability was discovered in the Go programming language's os package in versions     prior to 1.24.3. The vulnerability allows improper access to the parent directory of an os.Root by opening     a filename ending in ../. When exploited, this vulnerability permits an attacker to open the parent     directory of the Root, though it does not allow access to ancestors of the parent or files contained     within the parent directory. This issue has been fixed in Go 1.24.3, where Root now correctly returns an     error when such access is attempted. (CVE-2025-22873)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01551-1 advisory.

    Update to go1.24.3 (bsc#1236217):

    Security fixes:

     - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)

    Changelog:

     * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory
     * go#73082 os: Root.Open panics when opening a symlink referencing the root
     * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable
     * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in     supportedVersions
     * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/     runtime.OSLockThread
     * go#73192 runtime: -race data race map traceback report incorrect functions
     * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large
     * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64
     * go#73440 cmd/compile: infinite loop in the inliner
     * go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1551-1 advisory.

    Update to go1.24.3 (bsc#1236217):

    Security fixes:

     - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)

    Changelog:

     * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory
     * go#73082 os: Root.Open panics when opening a symlink referencing the root
     * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable
     * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in     supportedVersions
     * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/     runtime.OSLockThread
     * go#73192 runtime: -race data race map traceback report incorrect functions
     * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large
     * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64
     * go#73440 cmd/compile: infinite loop in the inliner
     * go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.24.x prior to 1.24.3. It is, therefore, affected by a directory traversal vulnerability that makes it possible to improperly access the parent directory of an os.Root.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238043	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:01846-1)	Nessus	SuSE Local Security Checks	high
237671	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2025-977)	Nessus	Amazon Linux Local Security Checks	medium
237541	SUSE SLED15 / SLES15 Security Update : go1.24 (SUSE-SU-2025:01551-1)	Nessus	SuSE Local Security Checks	medium
236789	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:1551-1)	Nessus	SuSE Local Security Checks	medium
235470	Golang 1.24.x < 1.24.3 Directory Traversal	Nessus	Misc.	high

Detections

Analytics

CVE-2025-22873

medium

Tenable Plugins

high

medium

medium

medium

high