Arch Linux Security Advisory ASA-202506-4
=========================================

Severity: Medium
Date    : 2025-06-07
CVE-ID  : CVE-2025-4673 CVE-2025-22874
Package : go
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2896

Summary
=======

The package go before version 1.24.4-1 is vulnerable to multiple issues
including certificate verification bypass and information disclosure.

Resolution
==========

Upgrade to 1.24.4-1.

# pacman -Syu "go>=1.24.4-1"

The problems have been fixed upstream in version 1.24.4.

Workaround
==========

None.

Description
===========

- CVE-2025-4673 (information disclosure)

net/http: Proxy-Authorization and Proxy-Authenticate headers were not
cleared during cross-origin redirects, potentially leaking sensitive
credentials in proxy-authenticated environments.

- CVE-2025-22874 (certificate verification bypass)

crypto/x509: When VerifyOptions.KeyUsages includes ExtKeyUsageAny,
certificate policy validation is unintentionally disabled. This affects
certificate chains with policy constraints, which are uncommon but
security-relevant when used.

Impact
======

A remote attacker can exploit Go's HTTP client to leak proxy
credentials via cross-origin redirects, or bypass certificate policy
validation when ExtKeyUsageAny is used during TLS verification.

References
==========

https://github.com/golang/go/issues/73816
https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A/m/XDxq7uidAgAJ
https://go.dev/doc/devel/release#go1.24.4
https://github.com/golang/go/issues/73612
https://security.archlinux.org/CVE-2025-4673
https://security.archlinux.org/CVE-2025-22874