mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/go: security bump to version 1.25.6

Browse Source 
Fixes the following vulnerabilities:

- CVE-2025-61728: archive/zip: denial of service when parsing arbitrary ZIP
  archives

  archive/zip used a super-linear file name indexing algorithm that is
  invoked the first time a file in an archive is opened.  This can lead to a
  denial of service when consuming a maliciously constructed ZIP archive.

- CVE-2025-61726: net/http: memory exhaustion in Request.ParseForm

  When parsing a URL-encoded form net/http may allocate an unexpected amount
  of memory when provided a large number of key-value pairs.  This can
  result in a denial of service due to memory exhaustion.

- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated
  session ticket keys, session resumption does not account for the
  expiration of full certificate chain

  The Config.Clone methods allows cloning a Config which has already been
  passed to a TLS function, allowing it to be mutated and reused.

  If Config.SessionTicketKey has not been set, and
  Config.SetSessionTicketKeys has not been called, crypto/tls will generate
  random session ticket keys and automatically rotate them.  Config.Clone
  would copy these automatically generated keys into the returned Config,
  meaning that the two Configs would share session ticket keys, allowing
  sessions created using one Config could be used to resume sessions with
  the other Config.  This can allow clients to resume sessions even though
  the Config may be configured such that they should not be able to do so.

- CVE-2025-61731: cmd/go: unexpected code execution when invoking toolchain

  The Go toolchain supports multiple VCS which are used retrieving modules
  and embedding build information into binaries.

  On systems with Mercurial installed (hg) downloading modules (e.g.  via go
  get or go mod download) from non-standard sources (e.g.  custom domains)
  can cause unexpected code execution due to how external VCS commands are
  constructed.

  On systems with Git installed, downloading and building modules with
  malicious version strings could allow an attacker to write to arbitrary
  files on the system the user has access to.  This can only be triggered by
  explicitly providing the malicious version strings to the toolchain, and
  does not affect usage of @latest or bare module paths.

  The toolchain now uses safer VCS options to prevent misinterpretation of
  untrusted inputs.  In addition, the toolchain now disallows module version
  strings prefixed with a "-" or "/" character.

- CVE-2025-61730: crypto/tls: handshake messages may be processed at the
  incorrect encryption level

  During the TLS 1.3 handshake if multiple messages are sent in records that
  span encryption level boundaries (for instance the Client Hello and
  Encrypted Extensions messages), the subsequent messages may be processed
  before the encryption level changes.  This can cause some minor
  information disclosure if a network-local attacker can inject messages
  during the handshake.

For details, see the announcement:
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Peter Korsgaard
2026-01-27 17:47:13 +01:00
committed by Julien Olivain
parent fb523a75cf
commit 22137df16b
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
package/go/go.hash
View File

@@ -1,9 +1,9 @@
# sha256 checksum from https://go.dev/dl/
sha256 22a5fd0a91efcd28a1b0537106b9959b2804b61f59c3758b51e8e5429c1a954f go1.25.5.src.tar.gz
sha256 db908a86e888574ed3432355ba5372ad3ef2c0821ba9b91ceaa0f6634620c40c go1.25.5.linux-386.tar.gz
sha256 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b go1.25.5.linux-amd64.tar.gz
sha256 b00b694903d126c588c378e72d3545549935d3982635ba3f7a964c9fa23fe3b9 go1.25.5.linux-arm64.tar.gz
sha256 0b27e3dec8d04899d6941586d2aa2721c3dee67c739c1fc1b528188f3f6e8ab5 go1.25.5.linux-armv6l.tar.gz
sha256 f0904b647b5b8561efc5d48bb59a34f2b7996afab83ccd41c93b1aeb2c0067e4 go1.25.5.linux-ppc64le.tar.gz
sha256 a5d0a72b0dfd57f9c2c0cdd8b7e0f401e0afb9e8c304d3410f9b0982ce0953da go1.25.5.linux-s390x.tar.gz
sha256 58cbf771e44d76de6f56d19e33b77d745a1e489340922875e46585b975c2b059 go1.25.6.src.tar.gz
sha256 59fe62eee3cca65332acef3ebe9b6ff3272467e0a08bf7f68f96334902bf23b9 go1.25.6.linux-386.tar.gz
sha256 f022b6aad78e362bcba9b0b94d09ad58c5a70c6ba3b7582905fababf5fe0181a go1.25.6.linux-amd64.tar.gz
sha256 738ef87d79c34272424ccdf83302b7b0300b8b096ed443896089306117943dd5 go1.25.6.linux-arm64.tar.gz
sha256 679f0e70b27c637116791e3c98afbf8c954deb2cd336364944d014f8e440e2ae go1.25.6.linux-armv6l.tar.gz
sha256 bee02dbe034b12b839ae7807a85a61c13bee09ee38f2eeba2074bd26c0c0ab73 go1.25.6.linux-ppc64le.tar.gz
sha256 3d97cc5670a0da9cb177037782129f0bf499ecb47abc40488248548abd2c2c35 go1.25.6.linux-s390x.tar.gz
sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE

2
package/go/go.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
GO_VERSION = 1.25.5
GO_VERSION = 1.25.6
HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache