golang-1.25.7-1.el9_7
エラータID: AXSA:2026-196:02
リリース日:
2026/02/18 Wednesday - 22:32
題名:
golang-1.25.7-1.el9_7
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Go の net/url パッケージの net/http.Request.ParseForm()
メソッドには、クエリ内のパラメーター数を制限を実施していないこと
に起因して意図せず大量のメモリを消費してしまう問題があるため、
リモートの攻撃者により、サービス拒否攻撃 (メモリ枯渇) を可能と
する脆弱性が存在します。(CVE-2025-61726)
- Go の archive/zip パッケージ内のファイル名のインデックス処理
には、CPU リソースを多く消費してしまうアルゴリズムが使用されている
問題があるため、リモートの攻撃者により、細工された ZIP アーカイブ
ファイルの処理を介して、サービス拒否攻撃 (CPU リソース枯渇) を可能
とする脆弱性が存在します。(CVE-2025-61728)
- Go には、コメント行の解析方法の不備に起因して cgo バイナリに
意図しないコードが混入してしまう問題があるため、リモートの攻撃者
により、任意のコードの実行を可能とする脆弱性が存在します。
(CVE-2025-61732)
- Go の crypto/tls パッケージには、Config 内の ClientCAs
フィールドまたは RootCAs フィールドが最初のハンドシェイクと再開後
のハンドシェイクの間で変更されている場合、本来失敗するはずの再開後
のハンドシェイクが成功してしまう問題があるため、リモートの攻撃者に
より、不正な認証を可能とする脆弱性が存在します。(CVE-2025-68121)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-61726
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
CVE-2025-61728
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
CVE-2025-61732
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVE-2025-68121
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
追加情報:
N/A
ダウンロード:
SRPMS
- golang-1.25.7-1.el9_7.src.rpm
MD5: 99363e37b21e42b20e63a93d5976f68d
SHA-256: cf11cbe1cc18d9843359affa078cd2246caf86c4538fcdcaf291115b02aed5fe
Size: 32.78 MB
Asianux Server 9 for x86_64
- golang-1.25.7-1.el9_7.x86_64.rpm
MD5: b5387e19e731d0f2b666be15a7d2d07e
SHA-256: a63c12166595e26e3972846749349309bfe28bbe5eeb08cd684e18ddabe9301d
Size: 1.25 MB - golang-bin-1.25.7-1.el9_7.x86_64.rpm
MD5: 5cf78d3cf69e0e242c95d4f71eb6e632
SHA-256: 79c59e96bd908ccbdd0d2e8bc79772f1a6df5e4a29335d62b6f609146a9e45ce
Size: 36.48 MB - golang-docs-1.25.7-1.el9_7.noarch.rpm
MD5: fb913c44c12794cfe5e2e57b49c63106
SHA-256: 1aa98b400e0be9a859c3398b4b533b2cee39ef9ad95d0a99dd696c9963f45d7d
Size: 108.76 kB - golang-misc-1.25.7-1.el9_7.noarch.rpm
MD5: b105c54bbc5da5b1fa474432600edcef
SHA-256: 4c379c3772a3873a012c87c301811143005a6a4d856b106d3b94f21cbe0586a7
Size: 41.73 kB - golang-race-1.25.7-1.el9_7.x86_64.rpm
MD5: 2e142794326c47b458675ff43732542c
SHA-256: f777e3fdc8750cd2276212444075bec046d489bab423f4b1afc2c9a15e6163a3
Size: 1.68 MB - golang-src-1.25.7-1.el9_7.noarch.rpm
MD5: 569886448f0a914d3c58a4124ccdadc5
SHA-256: 17b608a00b9b6acf44d60c93abd52baba7275f030485cb54d377f2a55be33b45
Size: 11.43 MB - golang-tests-1.25.7-1.el9_7.noarch.rpm
MD5: b1a4967c84cbbf3b4df04e134c75d10d
SHA-256: bed56f62748031e74ae91588388d665c7045ce700a3831ec7d2335d20dc60a64
Size: 11.48 MB - go-toolset-1.25.7-1.el9_7.x86_64.rpm
MD5: 6524614adda7100d3e8b4ef9df7bfb8c
SHA-256: 67a2699419da96b47540ed6c6b95e22dcc5af8baaccd3f3fa9b527a304ead16c
Size: 9.66 kB
English