MGASA-2025-0175
- Source
- https://advisories.mageia.org/MGASA-2025-0175.html
- Import Source
- https://advisories.mageia.org/MGASA-2025-0175.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2025-0175
- Related
- Published
- 2025-06-02T17:55:29Z
- Modified
- 2025-06-02T17:17:04Z
- Summary
- Updated golang packages fix security vulnerabilities
- Details
-
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied - CVE-2025-22870. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext - CVE-2025-22871.
- References
-
- https://advisories.mageia.org/MGASA-2025-0175.html
- https://bugs.mageia.org/show_bug.cgi?id=34078
- https://www.openwall.com/lists/oss-security/2025/03/07/2
- https://www.openwall.com/lists/oss-security/2025/04/04/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFNTP3P4URUREHKSWZQWIJPIXGRCFHUI/
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:9 / golang
Package
- Name
- golang
- Purl
- pkg:rpm/mageia/golang?arch=source&distro=mageia-9