VUL-0: CVE-2024-45341: go1.22,go1.23: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints VUL-0: CVE-2024-45336: go1.22,go1.23: net/http: sensitive headers incorrectly sent after cross-domain redirect go1.24 release tracking VUL-0: CVE-2024-45340: go1.24: cmd/go: GOAUTH credential leak VUL-0: CVE-2025-22865: go1.24: crypto/x509: ParsePKCS1PrivateKey panic with partial keys VUL-0: CVE-2025-22866 go1.22,go1.23,go1.24: crypto/elliptic: timing sidechannel for P-256 on ppc64le VUL-0: CVE-2025-22867: go1.24: cmd/go: arbitrary code execution during build on darwin jfkw important security

Security update for go1.24

This update for go1.24 fixes the following issues: go1.24rc3 (released 2024-02-05) is a release candidate version of go1.24. (bsc#1236217) * CVE-2025-22866: crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le (bsc#1236801) * CVE-2025-22867: cmd/go: arbitrary code execution during build on darwin (bsc#1236839) * CVE-2024-45341: crypto/x509: properly check for IPv6 hosts in URIs (bsc#1236045) * CVE-2024-45336: net/http: persist header stripping across repeated redirects (bsc#1236046) * CVE-2025-22865: crypto/x509: avoid panic when parsing partial PKCS#1 private keys (bsc#1236361) * CVE-2024-45340: cmd/go: restore netrc preferences for GOAUTH and fix domain lookup (bsc#1236360) go1.24