go1.24-openssl (SUSE:Linux Enterprise Server for SAP Applications 15 SP3) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server for SAP Applications 15 SP3 package go1.24-openssl, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2025-4674 — CVSS 8.6 (high): The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS…
• CVE-2025-22874 — CVSS 7.5 (high): Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected…
• CVE-2025-47907 — CVSS 7.0 (high): Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned…
• CVE-2025-4673 — CVSS 6.8 (medium): Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
• CVE-2025-47906 — CVSS 6.5 (medium): If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath…
• CVE-2025-0913 — CVSS 5.5 (medium): os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix…