Critical Security Update: Go Programming Language Vulnerability in AlmaLinux Packages
Summary
ALSA-2025:13935: Important: golang security update. Affects go-toolset versions < 1.24.6-1.el9_6. Fixed in 1.24.6-1.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go programming language, commonly referred to as Golang, is a statically typed, compiled language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other software applications. The affected packages in this advisory include go-toolset, golang, golang-bin, golang-docs, golang-misc, golang-race, golang-src, and golang-tests, all of which provide essential tools and libraries for Go development. The vulnerability in question poses a significant risk to users of these packages, necessitating immediate attention and remediation.
Vulnerability Detail
The vulnerability identified as CVE-2025-4674 is a command execution flaw within the Go version control system (VCS). This issue arises when the 'go' command is used inappropriately, potentially allowing an attacker to execute arbitrary commands on the host system. The ramifications of this vulnerability can be severe, including unauthorized access to sensitive data, system compromise, and the execution of malicious code. It is crucial for developers and system administrators to understand the implications of this vulnerability and take appropriate action to mitigate risks.
How To Fix
Minimum fixed version
1.24.6-1.el9_6
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the vulnerable commands in the Go VCS until the packages are updated. It is recommended to review the usage of the 'go' command in your applications and ensure that it is not exposed to untrusted input.
Conclusion
In summary, the Go programming language packages in AlmaLinux have a critical vulnerability that requires immediate attention. Users are advised to update their packages to the patched version to mitigate risks associated with CVE-2025-4674. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for go-toolset →
FAQ
CVE-2025-4674 is a command execution vulnerability in the Go programming language that can allow unauthorized command execution on the host system.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to unauthorized access, data breaches, and execution of malicious code, posing significant risks to affected systems.
You can update your Go packages by running the command 'sudo dnf update go-toolset golang golang-bin golang-docs golang-misc golang-race golang-src golang-tests' in your terminal.
Yes, avoid using the vulnerable commands in the Go VCS and review your application's usage of the 'go' command to prevent exposure to untrusted input.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
