Link following in Go programming language - CVE-2025-0913

Vulnerability identifier: #VU110252

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-0913

CWE-ID: CWE-59

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an insecure link following issue within the os.OpenFile(path, os.O_CREATE|O_EXCL) method when handling dangling symlinks on Windows systems. A local user can create a specially crafted symbolic link and write arbitrary files to the system.

Go programming language
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
Development Tools Module
openSUSE Leap
IBM Observability with Instana
Netcool Operations Insight
Splunk Operator for Kubernetes Add-on
Guardium Data Security Center (GDSC)
Splunk Enterprise
go1.23-race
go1.23-doc
go1.23
go1.23-openssl-race
go1.23-openssl-debuginfo
go1.23-openssl-doc
go1.23-openssl
go1.24-doc
go1.24
go1.24-race
go1.24-openssl-debuginfo
go1.24-openssl
go1.24-openssl-doc
go1.24-openssl-race

Install updates from vendor's website.

Go programming language - addressed in versions 1.23.10, 1.24.4
IBM Observability with Instana - update to 1.0.302
Netcool Operations Insight - update to 1.6.15
Guardium Data Security Center (GDSC) - update to 3.8.5
Splunk Enterprise - addressed in versions 9.2.12, 9.3.9, 9.3.10, 9.4.8, 9.4.9, 10.0.3, 10.0.4, 10.2.1
go1.23-race - update to 1.23.10-150000.1.34.1
go1.23-doc - update to 1.23.10-150000.1.34.1
go1.23 - update to 1.23.10-150000.1.34.1
go1.23-openssl-race - update to 1.23.12-150600.13.9.1
go1.23-openssl-debuginfo - update to 1.23.12-150600.13.9.1
go1.23-openssl-doc - update to 1.23.12-150600.13.9.1
go1.23-openssl - update to 1.23.12-150600.13.9.1
go1.24-doc - update to 1.24.4-150000.1.26.1
go1.24 - update to 1.24.4-150000.1.26.1
go1.24-race - update to 1.24.4-150000.1.26.1
go1.24-openssl-debuginfo - update to 1.24.6-150600.13.9.1
go1.24-openssl - update to 1.24.6-150600.13.9.1
go1.24-openssl-doc - update to 1.24.6-150600.13.9.1
go1.24-openssl-race - update to 1.24.6-150600.13.9.1
Splunk Operator for Kubernetes Add-on - update to 3.1.0

• https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A/m/XDxq7uidAgAJ
• https://github.com/golang/go/issues/73702

• Multiple vulnerabilities in Go programming language
• SUSE update for go1.24
• SUSE update for go1.23
• SUSE update for go1.24-openssl
• SUSE update for go1.23-openssl
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Splunk Enterprise Security update for third-party components
• Multiple vulnerabilities in Splunk Enterprise
• Splunk Operator for Kubernetes Add-on update for third-party components