Re: [Buildroot] [PATCH] package/go: security bump to version 1.23.10

[Peter Korsgaard via buildroot <buildroot@buildroot.org>]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > go1.23.9 (released 2025-05-06) includes fixes to the runtime and the linker.
 > go1.23.10 (released 2025-06-05) includes security fixes to the net/http and
 > os packages, as well as bug fixes to the linker.

 > Fixes the following security vulnerabilities:

 > - CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin
 >   redirect

 >   Proxy-Authorization and Proxy-Authenticate headers persisted on
 >   cross-origin redirects potentially leaking sensitive information

 > - CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and
 >   Windows

 >   os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and
 >   Windows systems when the target path was a dangling symlink.  On Unix
 >   systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks.
 >   On Windows, when the target path was a symlink to a nonexistent location,
 >   OpenFile would create a file in that location.

 > - CVE-2025-22874: crypto/x509: usage of ExtKeyUsageAny disables policy validation

 >   Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny
 >   unintentionally disabled policy validation.  This only affected
 >   certificate chains which contain policy graphs, which are rather uncommon.

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot