Public bug reported: [Impact]
* Google has requested that the Go toolchain shipped in the jammy and noble images be updated. Both releases currently ship golang-1.24 1.24.4, which is affected by a number of CVEs that have been fixed in later 1.24.x point releases. * Backporting golang-1.24 1.24.13 (already shipping in resolute) to jammy and noble fixes the following CVEs: - CVE-2025-4674: cmd/go: unexpected command execution in untrusted VCS repositories - CVE-2025-47906: os/exec: LookPath may return unexpected paths - CVE-2025-47907: database/sql: incorrect results returned from Rows.Scan - CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad - CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress - CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints - CVE-2025-58189: crypto/tls: ALPN negotiation errors can contain arbitrary text - CVE-2025-61723: encoding/pem: quadratic complexity when parsing some invalid inputs - CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames - CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion - CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion - CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys - CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map - CVE-2025-61724: net/textproto: excessive CPU consumption in Reader.ReadResponse - CVE-2025-61729: crypto/x509: excessive resource consumption in printing error string for host certificate validation - CVE-2025-61727: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs - CVE-2025-61728: archive/zip: denial of service when parsing arbitrary ZIP archives - CVE-2025-61726: net/http: memory exhaustion in Request.ParseForm - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain - CVE-2025-61731: cmd/go: bypass of flag sanitization can lead to arbitrary code execution - CVE-2025-68119: cmd/go: unexpected code execution when invoking toolchain - CVE-2025-61730: crypto/tls: handshake messages may be processed at the incorrect encryption level - CVE-2025-61732: cmd/go: potential code smuggling using doc comments - crypto/x509: fixes in 1.24.9 (https://go.dev/issue/75828) * Go 1.24 is EOL and 1.24.13 is the final release in that series. * The updated compiler also unblocks rebuilding the snapd snap and the containers stack (runc-app, containerd-app, docker.io-app) on these releases. [Test Plan] * Install golang-1.24 from -proposed on jammy and noble * /usr/lib/go-1.24/bin/go version reports go1.24.13 * Build a hello-world program with the new toolchain; the result is a working statically linked ELF binary * (optional) rebuild runc-app against golang-1.24-go; the build succeeds [Where problems could occur] * This is a microrelease-only update (1.24.4 -> 1.24.13) of a toolchain package that is not the default golang-go on jammy or noble, so no reverse dependencies are affected and no rebuilds are triggered. * The delta consists of upstream security and bug fixes only; the same version (1.24.13-2) has been shipping in resolute since February 2026 without reported issues. [Other Info] * resolute already ships golang-1.24 1.24.13-2 * Previous golang backport SRUs: LP: #2103780 (1.24.4), LP: #2139254 (1.25) ** Affects: golang-1.24 (Ubuntu) Importance: Undecided Status: New ** Affects: golang-1.24 (Ubuntu Jammy) Importance: Undecided Status: New ** Affects: golang-1.24 (Ubuntu Noble) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164608 Title: [SRU] backport golang-1.24 (1.24.13) to jammy and noble To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/golang-1.24/+bug/2164608/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
