Threats Tagged 'cve-2025-22873'

This advisory concerns a security update for Red Hat Hardened Images RPM packages addressing multiple vulnerabilities identified by CVE-2025-22873 and 39 additional CVEs. The update includes bug fixes and enhancements targeting various security weaknesses categorized under numerous CWEs such as path traversal, resource exhaustion, and improper input validation. The vulnerabilities affect Red Hat Hardened Images and related components on the aarch64 architecture. No known exploits in the wild have been reported. The vendor advisory references an official Red Hat security advisory (RHSA-2026:7291) but does not explicitly detail patch availability in the provided content.

This advisory concerns a security update for Red Hat Hardened Images RPMs addressing multiple vulnerabilities identified by CVE-2025-22873 and 36 additional CVEs. The update is classified as high severity and involves a broad range of weaknesses (CWEs) including path traversal, resource exhaustion, and improper input validation. The vendor has published an advisory indicating the availability of an update for affected RPMs. No known exploits in the wild have been reported. Patch status is not explicitly confirmed in the advisory, but an update is available and users are directed to apply it via Red Hat's official channels.

CVE-2025-22873 is a relative path traversal vulnerability in the Go standard library's os package that allows opening the parent directory of a defined root directory by using a filename ending with ".. /". This vulnerability permits access only to the immediate parent directory, not to higher-level ancestors or files within the parent directory. It affects Go versions up to 1. 24. 0-0 and has a low CVSS score of 3. 8, indicating limited impact. Exploitation requires local privileges and no user interaction but can lead to limited confidentiality exposure by allowing directory traversal beyond intended boundaries. No known exploits are currently reported in the wild. European organizations using vulnerable Go versions in applications that enforce directory restrictions via os.

LowVulnerabilityGermanyFranceNetherlands+2#cve#cve-2025-22873#cwe-23