[ALSA-2026:46395] Important: go-fdo-server security update
Type:
security
Severity:
important
Release date:
2026-07-28
Description:
This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 go-fdo-server-1.0.1-2.el10_2.3.aarch64.rpm 68395fe2807056fe72d319477df0057f52c4b5f216e2c81b3a4e4afcbd1ef99e
noarch go-fdo-server-owner-1.0.1-2.el10_2.3.noarch.rpm 8a1f12fb60dd6f709e8d044b6d020d14de7e6afbde8dda5848544a5e669cff85
noarch go-fdo-server-rendezvous-1.0.1-2.el10_2.3.noarch.rpm caf1db0da6a4940dc368733c9e45509fe9a782dd4331421e6ca8bcf1a5779321
noarch go-fdo-server-manufacturer-1.0.1-2.el10_2.3.noarch.rpm cb7c2a74215550a5f2ce3d4355be09b754b0e502285caecb7e0f536ef2a0011f
x86_64 go-fdo-server-1.0.1-2.el10_2.3.x86_64.rpm c4741acefad17150edccd0b74b13025d64dad7a36e1846c0552733a875d0a7c1
x86_64_v2 go-fdo-server-1.0.1-2.el10_2.3.x86_64_v2.rpm 0f154c3ea758f81abc1c29ac3b9d352280d261a8147d0d163211ac37d905adfc
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.