Vulnerabilities found for glauth:2.4.0-22.04_49

[ROCKsBot]

Vulnerabilities found for glauth:2.4.0-22.04_49

ID	Target	Severity	Package
CVE-2025-47906	/bin/glauth	HIGH	stdlib
CVE-2025-47907	/bin/glauth	HIGH	stdlib

Affected tracks:

• 2-22.04_beta
• 2-22.04_candidate
• 2-22.04_edge
• 2-22.04_stable

Details: https://github.com/canonical/oci-factory/actions/runs/18025281700

[github-actions]

CVE issue checker

Applied labels: bug

Workflow: CVEs checker

[syncronize-issues-to-jira]

Thank you for reporting your feedback to us!

The internal ticket has been created: https://warthogs.atlassian.net/browse/IAM-1716.

This message was autogenerated

[wood-push-melon]

Based on https://seclists.org/oss-sec/2025/q3/77, these two CVEs are addressed on Go versions 1.24.6 and 1.23.12. We are currently using the snap Go 1.23/stable:

snap info go
name:      go
summary:   The Go programming language
publisher: Canonical✓
store-url: https://snapcraft.io/go
contact:   https://bugs.launchpad.net/go-snap/+filebug
license:   BSD-3-Clause
description: |
  Go is an open source programming language that enables the production of simple, efficient and
  reliable software at scale.
snap-id: Md1HBASHzP4i0bniScAjXGnOII9cEK6e
channels:
  latest/stable:       1.25.3       2025-10-14 (10971)  55MB classic
  latest/candidate:    ↑
  latest/beta:         ↑
  latest/edge:         1.25-ecc06f0 2025-04-09 (10896) 117MB classic
  1.25/stable:         1.25.3       2025-10-14 (10971)  55MB classic
  1.25/candidate:      1.25.3       2025-10-14 (10971)  55MB classic
  1.25/beta:           ↑
  1.25/edge:           ↑
  1.24-fips/stable:    1.24.4-fips  2025-07-30 (10916)  73MB classic
  1.24-fips/candidate: 1.24.4-fips  2025-07-29 (10916)  73MB classic
  1.24-fips/beta:      ↑
  1.24-fips/edge:      ↑
  1.24/stable:         1.24.9       2025-10-14 (10966)  73MB classic
  1.24/candidate:      1.24.9       2025-10-14 (10966)  73MB classic
  1.24/beta:           ↑
  1.24/edge:           ↑
  1.23-fips/stable:    1.23.8-fips  2025-05-28 (10898)  68MB classic
  1.23-fips/candidate: 1.23.8-fips  2025-05-28 (10898)  68MB classic
  1.23-fips/beta:      ↑
  1.23-fips/edge:      ↑
  1.23/stable:         1.23.12      2025-10-16 (10937)  68MB classic

So building and publishing again should be able to remediate the issues. @shipperizer, not sure this manually-triggered action is good enough: https://github.com/canonical/glauth-rock/actions/runs/18572915420.

[wood-push-melon]

With the new release, it should be good to go. Closing it for now.