Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Go to 1.23.6 for CVE-2025-22866 #4076

Open
MikeWillCook opened this issue Feb 12, 2025 · 0 comments · May be fixed by #4077
Open

Update Go to 1.23.6 for CVE-2025-22866 #4076

MikeWillCook opened this issue Feb 12, 2025 · 0 comments · May be fixed by #4077

Comments

@MikeWillCook
Copy link
Contributor

There is another go vulnerability reported against the esbuild binary (by trivy and grype) that is fixed in 1.23.6.

app/node_modules/@esbuild/linux-arm64/bin/esbuild (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                             │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2025-22866 │ MEDIUM   │ fixed  │ v1.23.5           │ 1.22.12, 1.23.6, 1.24.0-rc.3 │ crypto/internal/nistec: golang: Timing sidechannel for P-256 │
│         │                │          │        │                   │                              │ on ppc64le in crypto/internal/nistec                         │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2025-22866                   │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘
@MikeWillCook MikeWillCook linked a pull request Feb 12, 2025 that will close this issue
@MikeWillCook MikeWillCook changed the title Update go to 1.23.6 for CVE-2025-22866 Update Go to 1.23.6 for CVE-2025-22866 Feb 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant