{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"HIGH" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"['announces:', \"We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n * crypto/x509: incorrect enforcement of email constraints\\n\\n When verifying a certificate chain which contains a certificate containing\\n multiple email address constraints (composed of the full email address)\\n which share common local portions (the portion of the address before the '@'\\n character) but different domain portions (the portion of the address after\\n the '@' character), these constraints will not be properly applied, and only\\n the last constraint will be considered.\\n\\n This can allow certificates in the chain containing email addresses which\\n are either not permitted or excluded by the relevant constraints to be\\n returned by calls to Certificate.Verify. Since the name constraint checks\\n happen after chain building is complete, this only applies to certificate\\n chains which chain to trusted roots (root certificates either in\\n VerifyOptions.Roots or in the system root certificate pool), requiring a\\n trusted CA to issue certificates containing either not permitted or\\n excluded email addresses.\\n\\n This issue only affects Go 1.26.\\n\\n Thanks to Jakub Ciolek for reporting this issue.\\n\\n This is CVE-2026-27137 and Go issue\", '.\\n\\n * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n Certificate verification can panic when a certificate in the chain has an\\n empty DNS name and another certificate in the chain has excluded name\\n constraints. This can crash programs that are either directly verifying\\n X.509 certificate chains, or those that use TLS.\\n\\n Since the name constraint checks happen after chain building is complete,\\n this only applies to certificate chains which chain to trusted roots (root\\n certificates either in VerifyOptions.Roots or in the system root certificate\\n pool), requiring a trusted CA to issue certificates containing malformed DNS\\n names.\\n\\n This issue only affects Go 1.26.\\n\\n Thanks to Jakub Ciolek for reporting this issue.\\n\\n This is CVE-2026-27138 and Go issue', '.\\n\\n * html/template: URLs in meta content attribute actions are not escaped\\n\\n Actions which insert URLs into the content attribute of HTML meta tags are\\n not escaped. This can allow XSS if the meta tag also has an http-equiv\\n attribute with the value \"refresh\".\\n\\n A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n used to disable escaping URLs in actions in the meta content attribute which\\n follow \"url=\" by setting htmlmetacontenturlescape=0.\\n\\n This is CVE-2026-27142 and Go issue', '.\\n\\n * net/url: reject IPv6 literal not at start of host\\n\\n The Go standard library function net/url.Parse insufficiently\\n validated the host/authority component and accepted some invalid URLs\\n by effectively treating garbage before an IP-literal as ignorable.\\n The function should have rejected this as invalid.\\n\\n To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n that do not appear at the start of the host subcomponent of a URL.\\n\\n Thanks to Masaki Hara (', ') of Wantedly.\\n\\n This is CVE-2026-25679 and Go issue', '.\\n\\n * os: FileInfo can escape from a Root\\n\\n On Unix platforms, when listing the contents of a directory using\\n File.ReadDir or File.Readdir the returned FileInfo could reference\\n a file outside of the Root in which the File was opened.\\n\\n The contents of the FileInfo were populated using the lstat system\\n call, which takes the path to the file as a parameter. If a component\\n of the full path of the file described by the FileInfo is replaced with\\n a symbolic link, the target of the lstat can be directed to another\\n location on the filesystem.\\n\\n The impact of this escape is limited to reading metadata provided by\\n lstat from arbitrary locations on the filesystem. This could be used\\n to p", "category":"general", "title":"Synopsis" } ], "publisher":null, "references":[ { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679" }, { "summary":"CVE-2026-25679 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/cve/2026/csaf-openeuler-cve-2026-25679.json" }, { "summary":"openEuler-SA-2026-4068", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4068" }, { "summary":"CVE-2026-25679", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-25679&packageName=git-lfs" } ], "title":"openEuler cve CVE-2026-25679", "tracking":{ "initial_release_date":"2026-09-30T16:04:00+08:00", "revision_history":[ { "date":"2026-09-30T16:04:00+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-09-30T16:04:00+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-09-30T16:04:00+08:00", "id":"CVE-2026-25679", "version":"1.0.0", "status":"interim" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"openEuler-24.03-LTS-SP4", "name":"openEuler-24.03-LTS-SP4" }, "name":"openEuler-24.03-LTS-SP4", "category":"product_version" } ], "category":"product_name" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"git-lfs-3.6.1-2.oe2403sp4.src.rpm", "name":"git-lfs-3.6.1-2.oe2403sp4.src.rpm" }, "name":"git-lfs-3.6.1-2.oe2403sp4.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"git-lfs-3.6.1-2.oe2403sp4.x86_64.rpm", "name":"git-lfs-3.6.1-2.oe2403sp4.x86_64.rpm" }, "name":"git-lfs-3.6.1-2.oe2403sp4.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"git-lfs-3.6.1-2.oe2403sp4.aarch64.rpm", "name":"git-lfs-3.6.1-2.oe2403sp4.aarch64.rpm" }, "name":"git-lfs-3.6.1-2.oe2403sp4.aarch64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"git-lfs-3.6.1-2.oe2403sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.src", "name":"git-lfs-3.6.1-2.oe2403sp4.src as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"git-lfs-3.6.1-2.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.x86_64", "name":"git-lfs-3.6.1-2.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"git-lfs-3.6.1-2.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.aarch64", "name":"git-lfs-3.6.1-2.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-25679", "notes":[ { "text":"['announces:', \"We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n * crypto/x509: incorrect enforcement of email constraints\\n\\n When verifying a certificate chain which contains a certificate containing\\n multiple email address constraints (composed of the full email address)\\n which share common local portions (the portion of the address before the '@'\\n character) but different domain portions (the portion of the address after\\n the '@' character), these constraints will not be properly applied, and only\\n the last constraint will be considered.\\n\\n This can allow certificates in the chain containing email addresses which\\n are either not permitted or excluded by the relevant constraints to be\\n returned by calls to Certificate.Verify. Since the name constraint checks\\n happen after chain building is complete, this only applies to certificate\\n chains which chain to trusted roots (root certificates either in\\n VerifyOptions.Roots or in the system root certificate pool), requiring a\\n trusted CA to issue certificates containing either not permitted or\\n excluded email addresses.\\n\\n This issue only affects Go 1.26.\\n\\n Thanks to Jakub Ciolek for reporting this issue.\\n\\n This is CVE-2026-27137 and Go issue\", '.\\n\\n * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n Certificate verification can panic when a certificate in the chain has an\\n empty DNS name and another certificate in the chain has excluded name\\n constraints. This can crash programs that are either directly verifying\\n X.509 certificate chains, or those that use TLS.\\n\\n Since the name constraint checks happen after chain building is complete,\\n this only applies to certificate chains which chain to trusted roots (root\\n certificates either in VerifyOptions.Roots or in the system root certificate\\n pool), requiring a trusted CA to issue certificates containing malformed DNS\\n names.\\n\\n This issue only affects Go 1.26.\\n\\n Thanks to Jakub Ciolek for reporting this issue.\\n\\n This is CVE-2026-27138 and Go issue', '.\\n\\n * html/template: URLs in meta content attribute actions are not escaped\\n\\n Actions which insert URLs into the content attribute of HTML meta tags are\\n not escaped. This can allow XSS if the meta tag also has an http-equiv\\n attribute with the value \"refresh\".\\n\\n A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n used to disable escaping URLs in actions in the meta content attribute which\\n follow \"url=\" by setting htmlmetacontenturlescape=0.\\n\\n This is CVE-2026-27142 and Go issue', '.\\n\\n * net/url: reject IPv6 literal not at start of host\\n\\n The Go standard library function net/url.Parse insufficiently\\n validated the host/authority component and accepted some invalid URLs\\n by effectively treating garbage before an IP-literal as ignorable.\\n The function should have rejected this as invalid.\\n\\n To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n that do not appear at the start of the host subcomponent of a URL.\\n\\n Thanks to Masaki Hara (', ') of Wantedly.\\n\\n This is CVE-2026-25679 and Go issue', '.\\n\\n * os: FileInfo can escape from a Root\\n\\n On Unix platforms, when listing the contents of a directory using\\n File.ReadDir or File.Readdir the returned FileInfo could reference\\n a file outside of the Root in which the File was opened.\\n\\n The contents of the FileInfo were populated using the lstat system\\n call, which takes the path to the file as a parameter. If a component\\n of the full path of the file described by the FileInfo is replaced with\\n a symbolic link, the target of the lstat can be directed to another\\n location on the filesystem.\\n\\n The impact of this escape is limited to reading metadata provided by\\n lstat from arbitrary locations on the filesystem. This could be used\\n to p", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.src", "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.aarch64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.src", "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.aarch64" ], "details":"git-lfs security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4068" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.src", "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:git-lfs-3.6.1-2.oe2403sp4.aarch64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-25679" } ] }