USN-7574-1: Go vulnerabilities

Q: Is the variable-time cryptographic issue relevant on all supported architectures?

No. The variable-time instruction issue (CVE-2025-22866) is described as affecting 64-bit Power (ppc64el) systems under certain circumstances. No architecture limitation is stated for the other listed issues.

Q: Which Ubuntu Go packages are identified as affected by this notice?

The notice identifies ubuntu/golang-1.22, ubuntu/golang-1.22-go, and ubuntu/golang-1.22-src. It also lists Ubuntu Ubuntu as affected software.

Q: Are the reported impacts limited to information disclosure?

No. The issues include possible exposure of sensitive information, bypass of certificate URI constraints, and denial of service. The denial-of-service issue is associated with IPv6 zone IDs during hostname matching in http/httpproxy.

Published Jun 18, 2025

Updated

Kyle Seely discovered that the Go net/http module did not properly handle sensitive headers during repeated redirects. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-45336) Juho Forsén discovered that the Go crypto/x509 module incorrectly handled IPv6 addresses during URI parsing. An attacker could possibly use this issue to bypass certificate URI constraints. (CVE-2024-45341) It was discovered that the Go crypto module did not properly handle variable time instructions under certain circumstances on 64-bit Power (ppc64el) systems. An attacker could possibly use this issue to expose sensitive information. (CVE-2025-22866) It was discovered that the Go http/httpproxy module did not properly handle IPv6 zone IDs during hostname matching. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-22870) Takeshi Kaneko discovered that the Go net/http module did not properly strip sensitive proxy headers during redirect requests. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-4673)

Affected Software

18 affected componentsFixes available

All of the following

ubuntu/golang-1.22<1.22.8-1ubuntu0.1

1.22.8-1ubuntu0.1

Ubuntu Ubuntu=24.10

All of the following

ubuntu/golang-1.22-go<1.22.8-1ubuntu0.1

1.22.8-1ubuntu0.1

Ubuntu Ubuntu=24.10

All of the following

ubuntu/golang-1.22-src<1.22.8-1ubuntu0.1

1.22.8-1ubuntu0.1

Ubuntu Ubuntu=24.10

All of the following

ubuntu/golang-1.22<1.22.2-2ubuntu0.4

1.22.2-2ubuntu0.4

Ubuntu Ubuntu=24.04

All of the following

ubuntu/golang-1.22-go<1.22.2-2ubuntu0.4

1.22.2-2ubuntu0.4

Ubuntu Ubuntu=24.04

All of the following

ubuntu/golang-1.22-src<1.22.2-2ubuntu0.4

1.22.2-2ubuntu0.4

Ubuntu Ubuntu=24.04

All of the following

ubuntu/golang-1.22<1.22.2-2~22.04.3

1.22.2-2~22.04.3

Ubuntu Ubuntu=22.04

All of the following

ubuntu/golang-1.22-go<1.22.2-2~22.04.3

1.22.2-2~22.04.3

Ubuntu Ubuntu=22.04

All of the following

ubuntu/golang-1.22-src<1.22.2-2~22.04.3

1.22.2-2~22.04.3

Ubuntu Ubuntu=22.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/golang-1.22 to a version that resolves this vulnerability.
Fixed in 1.22.8-1ubuntu0.1
Upgrade
Upgrade ubuntu/golang-1.22-go to a version that resolves this vulnerability.
Fixed in 1.22.8-1ubuntu0.1
Upgrade
Upgrade ubuntu/golang-1.22-src to a version that resolves this vulnerability.
Fixed in 1.22.8-1ubuntu0.1
Upgrade
Upgrade ubuntu/golang-1.22 to a version that resolves this vulnerability.
Fixed in 1.22.2-2ubuntu0.4
Upgrade
Upgrade ubuntu/golang-1.22-go to a version that resolves this vulnerability.
Fixed in 1.22.2-2ubuntu0.4
Upgrade
Upgrade ubuntu/golang-1.22-src to a version that resolves this vulnerability.
Fixed in 1.22.2-2ubuntu0.4
Upgrade
Upgrade ubuntu/golang-1.22 to a version that resolves this vulnerability.
Fixed in 1.22.2-2~22.04.3
Upgrade
Upgrade ubuntu/golang-1.22-go to a version that resolves this vulnerability.
Fixed in 1.22.2-2~22.04.3
Upgrade
Upgrade ubuntu/golang-1.22-src to a version that resolves this vulnerability.
Fixed in 1.22.2-2~22.04.3

Event History

Jun 18, 2025

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Is the variable-time cryptographic issue relevant on all supported architectures?

No. The variable-time instruction issue (CVE-2025-22866) is described as affecting 64-bit Power (ppc64el) systems under certain circumstances. No architecture limitation is stated for the other listed issues.

Which Ubuntu Go packages are identified as affected by this notice?

The notice identifies ubuntu/golang-1.22, ubuntu/golang-1.22-go, and ubuntu/golang-1.22-src. It also lists Ubuntu Ubuntu as affected software.

Are the reported impacts limited to information disclosure?

No. The issues include possible exposure of sensitive information, bypass of certificate URI constraints, and denial of service. The denial-of-service issue is associated with IPv6 zone IDs during hostname matching in http/httpproxy.

USN-7574-1: Go vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Is the variable-time cryptographic issue relevant on all supported architectures?

Which Ubuntu Go packages are identified as affected by this notice?

Are the reported impacts limited to information disclosure?

Company

Resources

Contact

Frequently Asked Questions

Is the variable-time cryptographic issue relevant on all supported architectures?

Which Ubuntu Go packages are identified as affected by this notice?

Are the reported impacts limited to information disclosure?