Assigning to our golang maintainer.

Assignee: bugsquad => joequant
CC: (none) => marja11

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Insufficient validation of bracketed IPv6 hostnames in net/url. (CVE-2025-47912)

Unbounded allocation when parsing GNU sparse map in archive/tar. (CVE-2025-58183)

Parsing DER payload can cause memory exhaustion in encoding/asn1. (CVE-2025-58185)

Lack of limit when parsing cookies can cause memory exhaustion in net/http. (CVE-2025-58186)

Quadratic complexity when checking name constraints in crypto/x509. (CVE-2025-58187)

Panic when validating certificates with DSA public keys in crypto/x509. (CVE-2025-58188)

ALPN negotiation error contains attacker controlled information in crypto/tls. (CVE-2025-58189)

Quadratic complexity when parsing some invalid inputs in encoding/pem. (CVE-2025-61723)

Excessive CPU consumption in Reader.ReadResponse in net/textproto. (CVE-2025-61724)

Excessive CPU consumption in ParseAddress in net/mail. (CVE-2025-61725)

References:
https://www.openwall.com/lists/oss-security/2025/10/08/1
========================

Updated packages in core/updates_testing:
========================
golang-1.24.9-1.mga9
golang-bin-1.24.9-1.mga9
golang-docs-1.24.9-1.mga9
golang-misc-1.24.9-1.mga9
golang-shared-1.24.9-1.mga9
golang-src-1.24.9-1.mga9
golang-tests-1.24.9-1.mga9

from SRPM:
golang-1.24.9-1.mga9.src.rpm

Status comment: Fixed upstream in 1.24.8 => (none)
Whiteboard: MGA9TOO => (none)
Source RPM: golang-1.24.6-1.mga10.src.rpm, golang-1.24.6-1.mga9.src.rpm => golang-1.24.6-1.mga9.src.rpm
Version: Cauldron => 9
Status: NEW => ASSIGNED
Assignee: joequant => qa-bugs

Used to build current version of docker
Looks good to me

Whiteboard: (none) => MGA9-64-OK,MGA9-32-OK

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Here is another case where packages relying on these vulnerable Go features need to be rebuilt or they will remain vulnerable to these issues. I'm glad to at least see the text in the advisory to that effect, but our user will remain vulnerable as long as those packages are not pushed.

CC: (none) => dan

My mistake—I was referring to the text in bug 34584. I will add it to this advisory as well:

  These packages fix the issues for the compiler only; applications using the
  functions still need to be rebuilt.

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0256.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED