Skip to content

security: fix CVE-2025-22868 #71490

Closed
Closed
security: fix CVE-2025-22868#71490
Assignees
thatnealpatel
Labels
FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.Securityvulncheck or vulndbIssues for the x/vuln or x/vulndb repo
Milestone
Unreleased

Description

@thatnealpatel
thatnealpatel
opened on Jan 30, 2025

This is a PRIVATE issue for CVE-2025-22868, tracked in http://b/392867809 and fixed by https://go-internal-review.git.corp.google.com/c/oauth2/+/1920.

/cc @golang/security and @golang/release

Activity

  1. thatnealpatel
    added
    release-blocker
    Security
    on Jan 30, 2025
  2. thatnealpatel
    added this to the Go1.25 milestone on Jan 30, 2025
  3. gabyhelp
    added
    vulncheck or vulndbIssues for the x/vuln or x/vulndb repo
    on Jan 30, 2025
  4. cagedmantis
    added
    NeedsFixThe path to resolution is known, but the work has not been done.
    on Jan 31, 2025
  5. thatnealpatel
    self-assigned this
    on Feb 4, 2025

  6. rolandshoemaker commented on Feb 24, 2025

    @rolandshoemaker
    rolandshoemaker
    on Feb 24, 2025
    Member

    Fixed by https://go.dev/cl/652155.

  7. rolandshoemaker
    closed this as completedon Feb 24, 2025
  8. dmitshur
    modified the milestones: Go1.25, Unreleased on Feb 25, 2025
  9. dmitshur
    removed
    release-blocker
    on Feb 25, 2025

  10. gopherbot commented on Mar 6, 2025

    @gopherbot
    gopherbot
    on Mar 6, 2025
    Contributor

    Change https://go.dev/cl/655455 mentions this issue: jws: improve fix for CVE-2025-22868

  11. gopherbot
    added a commit that references this issue on Mar 13, 2025

    jws: improve fix for CVE-2025-22868

    ce56909
  12. vthapar
    added a commit that references this issue on Mar 25, 2025

    Bump golang x/oauth2 to fix CVE-2025-22868

    4523d62
  13. openshift-merge-bot
    added a commit that references this issue on Mar 25, 2025

    Bump golang x/oauth2 to fix CVE-2025-22868

    214a983
  14. rokatyy
    added a commit that references this issue on Mar 27, 2025

    [Dependencies] Bump oauth2 (#3566)

    b5423cc
  15. shajmakh
    added 2 commits that reference this issue on Jun 16, 2025

    [KNI] go.mod: bump x/oauth2 0.23->0.27

    0135729

    [KNI] go.mod: bump x/oauth2 0.23.0->0.30.0

    626961b
  16. golang
    locked and limited conversation to collaborators on Mar 6, 2026
  17. gopherbot
    added
    FrozenDueToAge
    on Mar 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.Securityvulncheck or vulndbIssues for the x/vuln or x/vulndb repo

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions