Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Go to 1.23.7 for CVE-2025-22866 and CVE-2025-22870 #4076

Closed
MikeWillCook opened this issue Feb 12, 2025 · 1 comment · Fixed by #4077
Closed

Update Go to 1.23.7 for CVE-2025-22866 and CVE-2025-22870 #4076

MikeWillCook opened this issue Feb 12, 2025 · 1 comment · Fixed by #4077

Comments

@MikeWillCook
Copy link
Contributor

MikeWillCook commented Feb 12, 2025

There is another go vulnerability reported against the esbuild binary (by trivy and grype) that is fixed in 1.23.6, and another fixed in 1.23.7.

app/node_modules/@esbuild/linux-arm64/bin/esbuild (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                             │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2025-22866 │ MEDIUM   │ fixed  │ v1.23.5           │ 1.22.12, 1.23.6, 1.24.0-rc.3 │ crypto/internal/nistec: golang: Timing sidechannel for P-256 │
│         │                │          │        │                   │                              │ on ppc64le in crypto/internal/nistec                         │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2025-22866                   │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘
@MikeWillCook MikeWillCook changed the title Update go to 1.23.6 for CVE-2025-22866 Update Go to 1.23.6 for CVE-2025-22866 Feb 13, 2025
@uvulpos
Copy link

uvulpos commented Feb 19, 2025

Maybe it's time for renovate-bot to prevent security issues like that

@MikeWillCook MikeWillCook changed the title Update Go to 1.23.6 for CVE-2025-22866 Update Go to 1.23.7 for CVE-2025-22866 and CVE-2025-22870 Mar 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants