Red Hat Security Advisory

RHSA-2025:13935

golang security update

Released 2025-08-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.24.6-1.el9_6, golang-1.24.6-1.el9_6, golang-bin-1.24.6-1.el9_6 +5

Fixes 3 records

TI-2025-04172 CVE-2025-4674 · GHSA-wprm-fgrx-xj42

Unexpected command execution in untrusted VCS repositories in cmd/go

MEDIUM 40

The go command may execute unexpected commands when operating in untrusted VCS repositories.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00475 Published 2025-07-29 Fixed in 1.23.11, 1.24.5 CWE-73

TI-2025-30311 CVE-2025-47907 · GHSA-j5pm-7495-qmr3

Incorrect results returned from Rows.Scan in database/sql

LOW 31

Cancelling a query (e.g.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00406 Published 2025-08-07 Partial fix · 1.23.12, 1.24.6 CWE-362

TI-2025-30310 CVE-2025-47906 · GHSA-gwrf-jf3h-w649

Unexpected paths returned from LookPath in os/exec

LOW 30

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpecte…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0055 Published 2025-09-18 Partial fix · 1.23.12, 1.24.6