Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN194

_____________________________________________________________________

DATE                : 02/04/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Go versions prior to 1.24.2, 
                                       1.23.8.

=====================================================================
https://groups.google.com/g/golang-nuts/c/YtY7XrboO40
_____________________________________________________________________


Hello gophers,

We have just released Go versions 1.24.2 and 1.23.8, minor point
releases.

These minor releases include 1 security fixes following the security
policy:

    net/http: request smuggling through invalid chunked data

    The net/http package accepted data in the chunked transfer encoding
    containing an invalid chunk-size line terminated by a bare LF.
    When used in conjunction with a server or proxy which incorrectly
    interprets a bare LF in a chunk extension as part of the extension,
    this could permit request smuggling.

    The net/http package now rejects chunk-size lines containing a
bare LF.

    Thanks to Jeppe Bonde Weikop for reporting this issue.

    This is CVE-2025-22871 and Go issue https://go.dev/issue/71988.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.24.2

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
git checkout go1.24.2 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Carlos and Dmitri for the Go team

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================