[CLSA-2026:1789552828] golang: Fix of CVE-2026-27139
Type:
security
Severity:
Low
Release date:
2026-09-16 10:00:38 UTC
Description:
- CVE-2026-27139: populate FileInfo with an fstatat relative to the directory descriptor instead of a path-based lstat in File.ReadDir and File.Readdir, so a FileInfo can no longer describe a file outside the os.Root it was opened in
CVEs fixed:
Updated packages:
  • go-toolset-1.25.7-1.el9_6.tuxcare.els17.x86_64.rpm
    sha:95ce50f854f790a5310302c084223efde339b87fb7282bc6aa8f8d36e490a6dc
  • golang-1.25.7-1.el9_6.tuxcare.els17.x86_64.rpm
    sha:98800fbfa5dbcd0cdacecd5e38628f74b8413e63e28fbb3355449fdaa12effc3
  • golang-bin-1.25.7-1.el9_6.tuxcare.els17.x86_64.rpm
    sha:c6df7f9808c1f0b8214fd50805b277b2e264d2bc307e938283bad1b63151aa63
  • golang-docs-1.25.7-1.el9_6.tuxcare.els17.noarch.rpm
    sha:175d6d4acaa11a590dd162862f5efc5417743c13d83d6c8aa1fbb7436ad23e51
  • golang-misc-1.25.7-1.el9_6.tuxcare.els17.noarch.rpm
    sha:c485732b3d03f1237837e4be8ea38dfcc55bf1d7b85748a31f933bc53062fd13
  • golang-race-1.25.7-1.el9_6.tuxcare.els17.x86_64.rpm
    sha:46d65950c6c443380b0581881975f97d57954374510e9b042d9cda0e96444067
  • golang-src-1.25.7-1.el9_6.tuxcare.els17.noarch.rpm
    sha:0038ca92753785e828511452836ed9e33bb3941643941857c269812f850d28c0
  • golang-tests-1.25.7-1.el9_6.tuxcare.els17.noarch.rpm
    sha:0dee134562f0cc8b5e0038b0a53c54b9ce66b3609c9b93b454ed3205631ea1cd
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.