SB20260320125 - SUSE update for go1.25-openssl

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2025-61732)

The vulnerability allows a remote attacker to inject arbitrary code into the application.

The vulnerability exists due to improper input validation in cmd/cgo caused by discrepancy between how Go and C/C++ comments are parsed. A remote attacker can smuggle code into the resulting cgo binary.

2) Improper Certificate Validation (CVE-ID: CVE-2025-68121)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper certificate validation within HTTP/3 connections. A remote attacker can cause cause a client to resume a session with a server that it would not have resumed with during the initial handshake

3) Input validation error (CVE-ID: CVE-2026-25679)

The vulnerability allows a remote attacker to bypass URL parsing validation and potentially access unintended resources.

The vulnerability exists due to insufficient validation in net/url.Parse when handling IPv6 literals not located at the start of the host component. A remote attacker can send a specially crafted URL with an IPv6 literal preceded by garbage characters to bypass proper parsing and potentially redirect requests.

This issue affects any application using net/url.Parse to process untrusted URLs. The incorrect parsing may lead to misrouting or injection of unintended host components.

4) Path traversal (CVE-ID: CVE-2026-27139)

The vulnerability allows a local user to access file metadata outside the intended root directory.

The vulnerability exists due to improper handling of symbolic links in os.FileInfo when listing directory contents via File.ReadDir or File.Readdir on Unix platforms. A local user can replace a path component with a symbolic link to cause lstat to access a file outside the root, allowing metadata disclosure.

The impact is limited to reading file metadata such as size and existence; it does not allow reading or modifying file contents. The user must have access to the directory being listed and the ability to create or modify symbolic links within the path.

5) Cross-site scripting (CVE-ID: CVE-2026-27142)

The vulnerability allows a remote attacker to execute arbitrary script code in a victim's browser via cross-site scripting (XSS).

The vulnerability exists due to improper output neutralization in html/template when inserting URLs into the content attribute of HTML meta tags with an http-equiv="refresh" attribute. A remote attacker can craft a URL that is not properly escaped, leading to script execution when the page is rendered.

Exploitation requires user interaction, as the victim must load the malicious page. This vulnerability affects applications using the html/template package to generate such meta tags.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20260947-1/