Bug 34584 - golang new security issues CVE-2025-4790[67]
Summary: golang new security issues CVE-2025-4790[67]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK,MGA9-32-OK
Keywords: advisory, validated_update
Depends on: 34580
Blocks:
  Show dependency treegraph
 
Reported: 2025-08-27 13:42 CEST by Nicolas Salguero
Modified: 2025-09-01 20:21 CEST (History)
3 users (show)

See Also:
Source RPM: golang-1.24.5-1.mga9
CVE: CVE-2025-47906, CVE-2025-47907
Status comment: Fixed upstream in 1.24.6


Attachments

Description Nicolas Salguero 2025-08-27 13:42:00 CEST
Those issues were announced here:
https://www.openwall.com/lists/oss-security/2025/08/06/1
Nicolas Salguero 2025-08-27 13:42:50 CEST

Whiteboard: (none) => MGA9TOO
Status comment: (none) => Fixed upstream in 1.24.6
Source RPM: (none) => golang-1.24.5-1.mga10.src.rpm, golang-1.24.5-1.mga9.src.rpm
CVE: (none) => CVE-2025-47906, CVE-2025-47907

katnatek 2025-08-27 21:18:58 CEST

Assignee: bugsquad => j.alberto.vc

Comment 1 katnatek 2025-08-28 01:32:41 CEST
RPMS:
golang-1.24.6-1.mga9
golang-bin-1.24.6-1.mga9
golang-docs-1.24.6-1.mga9
golang-misc-1.24.6-1.mga9
golang-shared-1.24.6-1.mga9
golang-src-1.24.6-1.mga9
golang-tests-1.24.6-1.mga9

SRPM:
golang-1.24.6-1.mga9

Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
Source RPM: golang-1.24.5-1.mga10.src.rpm, golang-1.24.5-1.mga9.src.rpm => golang-1.24.5-1.mga9
Assignee: j.alberto.vc => qa-bugs

katnatek 2025-08-28 01:44:14 CEST

Keywords: (none) => advisory

Comment 2 katnatek 2025-08-28 02:49:13 CEST
Used to build docker without issues

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK,MG9.32-ok

katnatek 2025-08-28 02:49:29 CEST

Whiteboard: MGA9-64-OK,MG9.32-ok => MGA9-64-OK,MG9.32-OK

katnatek 2025-08-28 02:50:00 CEST

Whiteboard: MGA9-64-OK,MG9.32-OK => MGA9-64-OK,MG9-32-OK

katnatek 2025-08-28 02:50:45 CEST

Whiteboard: MGA9-64-OK,MG9-32-OK => MGA9-64-OK,MGA9-32-OK

katnatek 2025-08-28 02:55:15 CEST

Depends on: (none) => 34580

Comment 3 Thomas Andrews 2025-08-28 14:18:21 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 4 Dan Fandrich 2025-08-29 08:00:51 CEST
Every Go program that uses this function must be recompiled to pick up this fix once this package has been pushed.

CC: (none) => dan

Comment 5 katnatek 2025-08-29 09:56:46 CEST
(In reply to Dan Fandrich from comment #4)
> Every Go program that uses this function must be recompiled to pick up this
> fix once this package has been pushed.
If you can find the packages that cuold need rebuild and
provide a list
If not then delay the update is worst
we already have other golang components that
need atention in their own security reports &
lot of them need to be checked for cauldron

That will be a better use of packagers energy

You know if you want this be delayed
but with the actual manpower & the focus in
get mageia 10 ready is more possible
other version fixing additional cves come out
Comment 6 Dan Fandrich 2025-08-29 17:27:05 CEST
This update doesn't need to be delayed, but it's not complete until those other packages are recompiled. And technically, all those other packages should be included in the .adv since they're all affected by CVE-2025-47906 and CVE-2025-47907.

We've been ignoring this problem in Mageia which means our users are currently vulnerable to a host of issues despite security updates being pushed. For reference, the covering bug is #33973.
Comment 7 Dan Fandrich 2025-08-30 18:05:19 CEST
At the very least, the advisory should point out that only the compiler and standard library are updated for these CVEs and previously-compiled programs are still vulnerable.
Comment 8 katnatek 2025-08-30 18:56:25 CEST
(In reply to Dan Fandrich from comment #7)
> At the very least, the advisory should point out that only the compiler and
> standard library are updated for these CVEs and previously-compiled programs
> are still vulnerable.

Added this text
This packages fix the issues for the compiler, applications using the
  functions should need rebuild.
Comment 9 Mageia Robot 2025-09-01 20:21:09 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0221.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.