mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/go: security bump to version 1.25.7

Browse Source 
Fixes the following vulnerabilities:

CVE-2025-61732: cmd/cgo: remove user-content from doc strings in cgo ASTs

A discrepancy between how Go and C/C++ comments were parsed allowed for code
smuggling into the resulting cgo binary.

To prevent this behavior, the cgo compiler will no longer parse
user-provided doc comments.

CVE-2025-68121: crypto/tls: unexpected session resumption when using
Config.GetConfigForClient

Config.GetConfigForClient is documented to use the original Config's session
ticket keys unless explicitly overridden.  This can cause unexpected
behavior if the returned Config modifies authentication parameters, like
ClientCAs: a connection initially established with the parent (or a sibling)
Config can be resumed, bypassing the modified authentication requirements.

If ClientAuth is VerifyClientCertIfGiven or RequireAndVerifyClientCert (on
the server) or InsecureSkipVerify is false (on the client), crypto/tls now
checks that the root of the previously-verified chain is still in
ClientCAs/RootCAs when resuming a connection.

Go 1.26 Release Candidate 2, Go 1.25.6, and Go 1.24.12 had fixed a similar
issue related to session ticket keys being implicitly shared by
Config.Clone.  Since this fix is broader, the Config.Clone behavior change
has been reverted.

Note that VerifyPeerCertificate still behaves as documented: it does not
apply to resumed connections.  Applications that use
Config.GetConfigForClient or Config.Clone and do not wish to blindly resume
connections established with the original Config must use VerifyConnection
instead (or SetSessionTicketKeys or SessionTicketsDisabled).

For more details, see the announcement:
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f56dc6b122)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Peter Korsgaard
2026-02-10 08:49:53 +01:00
committed by Thomas Perale
parent dedc4383f7
commit 169122a397
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
package/go/go.hash
View File

@@ -1,9 +1,9 @@
# sha256 checksum from https://go.dev/dl/
sha256 58cbf771e44d76de6f56d19e33b77d745a1e489340922875e46585b975c2b059 go1.25.6.src.tar.gz
sha256 59fe62eee3cca65332acef3ebe9b6ff3272467e0a08bf7f68f96334902bf23b9 go1.25.6.linux-386.tar.gz
sha256 f022b6aad78e362bcba9b0b94d09ad58c5a70c6ba3b7582905fababf5fe0181a go1.25.6.linux-amd64.tar.gz
sha256 738ef87d79c34272424ccdf83302b7b0300b8b096ed443896089306117943dd5 go1.25.6.linux-arm64.tar.gz
sha256 679f0e70b27c637116791e3c98afbf8c954deb2cd336364944d014f8e440e2ae go1.25.6.linux-armv6l.tar.gz
sha256 bee02dbe034b12b839ae7807a85a61c13bee09ee38f2eeba2074bd26c0c0ab73 go1.25.6.linux-ppc64le.tar.gz
sha256 3d97cc5670a0da9cb177037782129f0bf499ecb47abc40488248548abd2c2c35 go1.25.6.linux-s390x.tar.gz
sha256 178f2832820274b43e177d32f06a3ebb0129e427dd20a5e4c88df2c1763cf10a go1.25.7.src.tar.gz
sha256 2866517e9ca81e6a2e85a930e9b11bc8a05cfeb2fc6dc6cb2765e7fb3c14b715 go1.25.7.linux-386.tar.gz
sha256 12e6d6a191091ae27dc31f6efc630e3a3b8ba409baf3573d955b196fdf086005 go1.25.7.linux-amd64.tar.gz
sha256 ba611a53534135a81067240eff9508cd7e256c560edd5d8c2fef54f083c07129 go1.25.7.linux-arm64.tar.gz
sha256 1ba07e0eb86b839e72467f4b5c7a5597d07f30bcf5563c951410454f7cda5266 go1.25.7.linux-armv6l.tar.gz
sha256 42124c0edc92464e2b37b2d7fcd3658f0c47ebd6a098732415a522be8cb88e3f go1.25.7.linux-ppc64le.tar.gz
sha256 c6b77facf666dc68195ecab05dbf0ebb4e755b2a8b7734c759880557f1c29b0c go1.25.7.linux-s390x.tar.gz
sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE

2
package/go/go.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
GO_VERSION = 1.25.6
GO_VERSION = 1.25.7
HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache