SUSE-SU-2026:2818-1

Details

Description of the patch:

This update for go1.26 fixes the following issues

Update to version go1.26.5 (bsc#1255111)
CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).

Affected Packages

go1.26

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5

Fixed in:

1.26.5-150000.1.18.1

go1.26-doc

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5

Fixed in:

1.26.5-150000.1.18.1

go1.26-race

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5

Fixed in:

1.26.5-150000.1.18.1

References

ADVISORY

https://bugzilla.suse.com/1245878

ADVISORY

https://bugzilla.suse.com/1255111

ADVISORY

https://bugzilla.suse.com/1264395

ADVISORY

https://bugzilla.suse.com/1271014

ADVISORY