Description
your project is currently using an outdated version of golang.org/x/crypto that is affected by CVE-2024-45337, an authorization bypass vulnerability related to the SSH ServerConfig.PublicKeyCallback API.
The vulnerability occurs when applications misuse the PublicKeyCallback in SSH server implementations. The SSH protocol allows clients to check whether public keys are acceptable before proving control of the corresponding private key. Older versions of the library (prior to v0.31.0) do not reliably enforce that the key ultimately used for authentication is the one acted on in authorization logic.
As a result, an attacker could send multiple public keys, authenticate with one, but cause the application to make authorization decisions based on a different key that the attacker doesn’t control — effectively bypassing intended authorization checks.
NVD
Affected Versions
golang.org/x/crypto versions < 0.31.0 are vulnerable.
Recommended Fix
Update golang.org/x/crypto to v0.31.0 or later
I can raise an MR and contribute to your project
Description
your project is currently using an outdated version of
golang.org/x/cryptothat is affected byCVE-2024-45337, an authorization bypass vulnerability related to the SSH ServerConfig.PublicKeyCallback API.The vulnerability occurs when applications misuse the PublicKeyCallback in SSH server implementations. The SSH protocol allows clients to check whether public keys are acceptable before proving control of the corresponding private key. Older versions of the library (prior to v0.31.0) do not reliably enforce that the key ultimately used for authentication is the one acted on in authorization logic.
As a result, an attacker could send multiple public keys, authenticate with one, but cause the application to make authorization decisions based on a different key that the attacker doesn’t control — effectively bypassing intended authorization checks.
NVD
Affected Versions
golang.org/x/crypto versions < 0.31.0 are vulnerable.
Recommended Fix
Update golang.org/x/crypto to v0.31.0 or later
I can raise an MR and contribute to your project