Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1333-1 advisory.

    - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: Fixed sensitive information disclosure to log file     (bsc#1227031)
    - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Fixed bad documentation of error handling in     ParseWithClaims leading to potentially dangerous situations (bsc#1232985)
    - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Fixed denial of     service in Go JOSE's Parsing (bsc#1237682)
    - CVE-2025-22870: cosign: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs (bsc#1238693)
    - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Fixed unexpected memory consumption during token     parsing (bsc#1239204)
    - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Fixed denial of service in the Key Exchange     (bsc#1239337)

    Other fixes:

    - Update to version 2.5.0 (jsc#SLE-23476):
      * Update sigstore-go to pick up bug fixes (#4150)
      * Update golangci-lint to v2, update golangci-lint-action (#4143)
      * Feat/non filename completions (#4115)
      * update builder to use go1.24.1 (#4116)
      * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
      * Remove cert log line (#4113)
      * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
      * bump to latest scaffolding release for testing (#4099)
      * increase 2e2_test docker compose tiemout to 180s (#4091)
      * Fix replace with compliant image mediatype (#4077)
      * Add TSA certificate related flags and fields for cosign attest (#4079)

    - Update to version 2.4.3 (jsc#SLE-23476):
      * Enable fetching signatures without remote get. (#4047)
      * Bump sigstore/sigstore to support KMS plugins (#4073)
      * sort properly Go imports (#4071)
      * sync comment with parameter name in function signature (#4063)
      * fix go imports order to be alphabetical (#4062)
      * fix comment typo and imports order (#4061)
      * Feat/file flag completion improvements (#4028)
      * Udpate builder to use go1.23.6 (#4052)
      * Refactor verifyNewBundle into library function (#4013)
      * fix parsing error in --only for cosign copy (#4049)
      * Fix codeowners syntax, add dep-maintainers (#4046)

    - Update to version 2.4.2 (jsc#SLE-23476):
      - Updated open-policy-agent to 1.1.0 library (#4036)
         -  Note that only Rego v0 policies are supported at this time
      - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
      - Add support for verifying root checksum in cosign initialize (#3953)
      - Detect if user supplied a valid protobuf bundle (#3931)
      - Add a log message if user doesn't provide --trusted-root (#3933)
      - Support mTLS towards container registry (#3922)
      - Add bundle create helper command (#3901)
      - Add trusted-root create helper command (#3876)       Bug Fixes:
      - fix: set tls config while retaining other fields from default http transport (#4007)
      - policy fuzzer: ignore known panics (#3993)
      - Fix for multiple WithRemote options (#3982)
      - Add nightly conformance test workflow (#3979)
      - Fix copy --only for signatures + update/align docs (#3904)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f1d2ae375e advisory.

    release 1.5.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-77ace1a41b advisory.

    Includes security fixes to the net/http package, as well as bug fixes to the runtime and the go command.
    [Full changelog](https://github.com/golang/go/issues?q=milestone%3AGo1.23.8+label%3ACherryPickApproved).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-37c6639afe advisory.

    - Resolve FTBFS
    - Resolves: rhbz#2352149
    - Adopt trivy for license detection to be consistent with cri-       tools[1.29..1.32]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f87fe38331 advisory.

    Resolve FTBFS and rhbz#2351926

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1094-1 advisory.

    warewulf4 was updated from version 4.5.8 to 4.6.0:

    - Security issues fixed for version 4.6.0:

      * CVE-2025-22869: Fixed Denial of Service vulnerability in the Key Exchange of golang.org/x/crypto/ssh     (bsc#1239322)
      * CVE-2025-22870: Fixed proxy bypass using IPv6 zone IDs (bsc#1238611)

    - User visible changes:

      * Default values `nodes.conf`:

        - The default values for `kernel command line`, `init parameters` and `root` are now set in the     `default` profile           and this profileshould be included in every profile.
          During the installation of an update an upgrade is done to `nodes.conf` which updates the database     accordingly.

      * Overlay split up:

        - The overlays `wwinit` and `runtime` are now split up in different overlays named according to their     role.
          The upgrade process will update the node database and replace the overlays `wwinit` and `runtime`     with a list           of overlays with same role.

      * Site and distribution overlays:

        - The overlays in `/var/lib/warewulf/overlays` should not be changed by the user any more.
          Site specific overlays are now sorted under `/etc/warewulf/overlays`.
          On upgrade, changed overlays are stored with the `rpmsave` suffix and move to           `/etc/warewulf/overlays/$OVERLAYNAME`.


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-913 advisory.

    NOTE: https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJNOTE:
    https://github.com/golang/go/issues/71984NOTE: Fixed by:
    https://github.com/golang/go/commit/334de7982f8ec959c74470dd709ceedfd6dbd50a (go1.24.1)NOTE: Fixed by:
    https://github.com/golang/go/commit/25177ecde0922c50753c043579d17828b7ee88e7 (go1.23.7) (CVE-2025-22870)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 300f86de-0e4d-11f0-ae40-b42e991fc52e advisory.

    security@golang.org reports:
    Matching of hosts against proxy patterns can improperly treat an             IPv6 zone ID as a hostname component.  For example, when the NO_PROXY             environment variable is set to *.example.com, a request             to [::1%25.example.com]:80` will incorrectly match and not             be proxied.
    go-redis is the official Redis client library for the Go programming             language.  Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially             responds out of order when `CLIENT SETINFO` times out during             connection establishment.  This can happen when the client is             configured to transmit its identity, there are network connectivity             issues, or the client was configured with aggressive timeouts.  The             problem occurs for multiple use cases.  For sticky connections, you             receive persistent out-of-order responses for the lifetime of the             connection.  All commands in the pipeline receive incorrect responses.
            When used with the default ConnPool once a connection is returned             after use with ConnPool#Put the read buffer will be checked and the             connection will be marked as bad due to the unread data.  This means             that at most one out-of-order response before the connection is             discarded.  This issue is fixed in 9.5.5, 9.6.3, and 9.7.3.  You             can prevent the vulnerability by setting the flag DisableIndentity             to true when constructing the client instance.
    golang-jwt is a Go implementation of JSON Web Tokens.  Prior to             5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a             call to strings.Split) its argument (which is untrusted data) on             periods.  As a result, in the face of a malicious request whose             Authorization header consists of Bearer followed by many period             characters, a call to that function incurs allocations to the tune             of O(n) bytes (where n stands for the length of the function's             argument), with a constant factor of about 16.  This issue is fixed             in 5.2.2 and 4.5.2.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of azcopy / git-lfs / influxdb / keda / prometheus-node-exporter / prometheus-process-exporter / telegraf installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22870 advisory.

  - Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For     example, when the NO_PROXY environment variable is set to *.example.com, a request to     [::1%25.example.com]:80` will incorrectly match and not be proxied. (CVE-2025-22870)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1055-1 advisory.

    - CVE-2025-22870: Fixed proxy bypass using IPv6 zone IDs (bsc#1238685).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of azcopy / git-lfs / influxdb / keda / prometheus-node-exporter / prometheus-process-exporter / telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22870 advisory.

  - Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For     example, when the NO_PROXY environment variable is set to *.example.com, a request to     [::1%25.example.com]:80` will incorrectly match and not be proxied. (CVE-2025-22870)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.23.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2795 advisory.

    net/http: sensitive headers incorrectly sent after cross-domain redirect

    The HTTP client drops sensitive headers after following a cross-domain redirect.For example, a request to     a.com/ containing an Authorization header which isredirected to b.com/ will not send that header to b.com.

    In the event that the client received a subsequent same-domain redirect, however,the sensitive headers     would be restored. For example, a chain of redirects froma.com/, to b.com/1, and finally to b.com/2 would     incorrectly send the Authorizationheader to b.com/2.

    Thanks to Kyle Seely for reporting this issue. (CVE-2024-45336)

    crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

    A certificate with a URI which has a IPv6 address with a zone ID mayincorrectly satisfy a URI name     constraint that applies to the certificatechain.

    Certificates containing URIs are not permitted in the web PKI, so thisonly affects users of private PKIs     which make use of URIs.

    Thanks to Juho Forsen of Mattermost for reporting this issue. (CVE-2024-45341)

    NOTE: https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJNOTE:
    https://github.com/golang/go/issues/71984NOTE: Fixed by:
    https://github.com/golang/go/commit/334de7982f8ec959c74470dd709ceedfd6dbd50a (go1.24.1)NOTE: Fixed by:
    https://github.com/golang/go/commit/25177ecde0922c50753c043579d17828b7ee88e7 (go1.23.7) (CVE-2025-22870)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1007-1 advisory.

    - CVE-2025-22870: Fixed proxy bypass using IPv6 zone IDs (bsc#1238688).

    Other fixes:
    - Updated to version 3.17.2
    - Updated to 0.37.0 for x/net

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-73800111e8 advisory.

    0.9.30, rebuild due golang CVE-2025-22870

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0980-1 advisory.

    - CVE-2025-27144: Fixed Denial of Service in Go JOSE's Parsing (bsc#1237679).
    - CVE-2024-45338: Fixed denial of service due to non-linear parsing of case-insensitive content     (bsc#1234794).
    - CVE-2024-45337: Fixed Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in     golang.org/x/crypto (bsc#1234595).
    - CVE-2025-22870: Fixed proxy bypass using IPv6 zone IDs (bsc#1238611).
    - CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239341).
    - CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-2fe21e3da5 advisory.

    Update to 0.40.0

    https://sw.kovidgoyal.net/kitty/changelog/#detailed-list-of-changes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-756c627691 advisory.

    Update to 0.40.0

    https://sw.kovidgoyal.net/kitty/changelog/#detailed-list-of-changes


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0873-1 advisory.

    - CVE-2025-22870: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs (bsc#1238702)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0866-1 advisory.

    - CVE-2025-22870: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs (bsc#1238702)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0803-1 advisory.

    - CVE-2025-22870: golang.org/x/net/proxy, golang.org/x/net/http/httpproxy: Fixed proxy bypass using IPv6     zone IDs (bsc#1238572)

      Other fixes:

      - Updated go version to go1.23.7 (bsc#1229122):
      * go#71985 go#71984 bsc#1238572 security: fix CVE-2025-22870 net/http, x/net/proxy,     x/net/http/httpproxy: proxy bypass using IPv6 zone IDs
      * go#71727 runtime: usleep computes wrong tv_nsec on s390x
      * go#71839 runtime: recover added in range-over-func loop body doesn't stop panic propagation /     segfaults printing error
      * go#71848 os: spurious SIGCHILD on running child process
      * go#71875 reflect: Value.Seq panicking on functional iterator methods
      * go#71915 reflect: Value.Seq iteration value types not matching the type of given int types
      * go#71962 runtime/cgo: does not build with -Wdeclaration-after-statement

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0802-1 advisory.

    - CVE-2025-22870: golang.org/x/net/proxy, golang.org/x/net/http/httpproxy: Fixed proxy bypass using IPv6     zone IDs (bsc#1238572)

      Other fixes:

      - Updated go version to go1.24.1 (bsc#1236217):
      * go#71986 go#71984 bsc#1238572 security: fix CVE-2025-22870 net/http, x/net/proxy,     x/net/http/httpproxy: proxy bypass using IPv6 zone IDs
      * go#71687 cmd/go: panics with GOAUTH='git dir' go get -x
      * go#71705 runtime: add linkname of runtime.lastmoduledatap for cloudwego/sonic
      * go#71728 runtime: usleep computes wrong tv_nsec on s390x
      * go#71745 crypto: add fips140 as an opaque GODEBUG setting and add documentation for it
      * go#71829 cmd/compile: fail to compile package in 1.24
      * go#71836 os: possible regression from Go 1.23 to Go 1.24 when opening DevNull with O_TRUNC
      * go#71840 runtime: recover added in range-over-func loop body doesn't stop panic propagation /     segfaults printing error
      * go#71849 os: spurious SIGCHILD on running child process
      * go#71855 cmd/compile: Pow10 freeze the compiler on certain condition on Go 1.24
      * go#71858 debug/buildinfo: false positives with external scanners flag for go117 binary in testdata
      * go#71876 reflect: Value.Seq panicking on functional iterator methods
      * go#71904 cmd/compile: nil dereference when storing field of non-nil struct value
      * go#71916 reflect: Value.Seq iteration value types not matching the type of given int types
      * go#71938 cmd/compile: 'fatal error: found pointer to free object' on arm64
      * go#71955 proposal: runtime: allow cleanups to run concurrently
      * go#71963 runtime/cgo: does not build with -Wdeclaration-after-statement
      * go#71977 syscall: js/wasm file operations fail on windows / node.js

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - golang-1.15 - None  golang-1.19 - None  golang-1.23 - None  golang-1.24 - None     (CVE-2025-22870)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
234602	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2025:1333-1)	Nessus	SuSE Local Security Checks	high
234465	Fedora 41 : podman-tui (2025-f1d2ae375e)	Nessus	Fedora Local Security Checks	medium
234461	Fedora 41 : golang (2025-77ace1a41b)	Nessus	Fedora Local Security Checks	medium
233955	Fedora 41 : cri-tools1.29 (2025-37c6639afe)	Nessus	Fedora Local Security Checks	medium
233952	Fedora 40 : containernetworking-plugins (2025-f87fe38331)	Nessus	Fedora Local Security Checks	medium
233793	SUSE SLES15 / openSUSE 15 Security Update : warewulf4 (SUSE-SU-2025:1094-1)	Nessus	SuSE Local Security Checks	medium
233692	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2025-913)	Nessus	Amazon Linux Local Security Checks	medium
233659	FreeBSD : gitea -- Multiple vulnerabilities (300f86de-0e4d-11f0-ae40-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	medium
233498	Azure Linux 3.0 Security Update: azcopy / git-lfs / influxdb / keda / prometheus-node-exporter / prometheus-process-exporter / telegraf (CVE-2025-22870)	Nessus	Azure Linux Local Security Checks	medium
233490	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : skopeo (SUSE-SU-2025:1055-1)	Nessus	SuSE Local Security Checks	medium
233447	CBL Mariner 2.0 Security Update: azcopy / git-lfs / influxdb / keda / prometheus-node-exporter / prometheus-process-exporter / telegraf (CVE-2025-22870)	Nessus	MarinerOS Local Security Checks	medium
233376	Amazon Linux 2 : golang (ALAS-2025-2795)	Nessus	Amazon Linux Local Security Checks	medium
233345	SUSE SLES15 / openSUSE 15 Security Update : helm (SUSE-SU-2025:1007-1)	Nessus	SuSE Local Security Checks	medium
233306	Fedora 41 : golang-github-openprinting-ipp-usb (2025-73800111e8)	Nessus	Fedora Local Security Checks	medium
233207	SUSE SLES15 / openSUSE 15 Security Update : apptainer (SUSE-SU-2025:0980-1)	Nessus	SuSE Local Security Checks	high
233202	Fedora 40 : kitty (2025-2fe21e3da5)	Nessus	Fedora Local Security Checks	medium
232830	Fedora 41 : kitty (2025-756c627691)	Nessus	Fedora Local Security Checks	medium
232758	SUSE SLES15 / openSUSE 15 Security Update : amazon-ssm-agent (SUSE-SU-2025:0873-1)	Nessus	SuSE Local Security Checks	medium
232752	SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2025:0866-1)	Nessus	SuSE Local Security Checks	medium
232325	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.23 (SUSE-SU-2025:0803-1)	Nessus	SuSE Local Security Checks	medium
232321	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:0802-1)	Nessus	SuSE Local Security Checks	medium
232161	Linux Distros Unpatched Vulnerability : CVE-2025-22870	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-22870

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

critical