Red Hat Security Advisory

RHSA-2025:7466

delve and golang security update

Released 2025-05-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) delve-1.24.1-1.el10_0, go-toolset-1.23.7-1.el10_0, golang-1.23.7-1.el10_0 +5

Fixes 3 records

TI-2024-30411 CVE-2024-45341 · GHSA-3f6r-qh9c-x6mm

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

LOW 28

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00556 Published 2025-01-28 Partial fix · 1.22.11, 1.23.5 +1

TI-2024-30406 CVE-2024-45336 · GHSA-7wrw-r4p8-38rx

Sensitive headers incorrectly sent after cross-domain redirect in net/http

LOW 28

The HTTP client drops sensitive headers after following a cross-domain redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0071 Published 2025-01-28 Partial fix · 1.22.11, 1.23.5 +1

TI-2025-16738 CVE-2025-22866 · GHSA-3whm-j4xm-rv8x

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

LOW 19

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.0029 Published 2025-02-06 Partial fix · 1.22.12, 1.23.6 +1