CVE-2025-58189: 
cAdvisor Analyse et atténuation des vulnérabilités

CVE-2025-58189 is a security vulnerability discovered in the Go programming language's crypto/tls package, specifically affecting versions before Go 1.24.8 and from Go 1.25.0 before Go 1.25.2. The vulnerability was disclosed on October 29, 2025, and affects the ALPN (Application-Layer Protocol Negotiation) negotiation process. The issue was reported by the National Cyber Security Centre Finland (Golang Announce, Ubuntu Security).

The vulnerability occurs when Conn.Handshake fails during ALPN negotiation, where the error returned on the server-side contains arbitrary attacker-controlled information provided by the client-side of the connection without proper escaping. The vulnerability has been assigned a CVSS 3.1 base score of 5.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network vector access, low attack complexity, and no required privileges or user interaction (Ubuntu Security).

This vulnerability affects programs that log these errors without additional sanitization, potentially allowing injection of attacker-controlled information into logs. The impact is primarily related to information disclosure through log injection, though the overall severity is considered relatively limited as most logging software typically filters control characters (Go Issue).

The vulnerability has been fixed in Go versions 1.24.8 and 1.25.2. Users are advised to upgrade to these versions or later to address the issue. The fix was implemented through commits 205d0865958a6d2342939f62dfeaf47508101976 (go1.25.2) and 2e1e356e33b9c792a9643749a7626a1789197bb9 (go1.24.8) (Debian Security).