Commit f1b883f
committed
Update golang.org/x/crypto
Dependabot bugs us about it with:
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass
in golang.org/x/crypto #11
```
Applications and libraries which misuse the
ServerConfig.PublicKeyCallback callback may be susceptible to an
authorization bypass.
The documentation for ServerConfig.PublicKeyCallback says that "A call
to this function does not guarantee that the key offered is in fact used
to authenticate." Specifically, the SSH protocol allows clients to
inquire about whether a public key is acceptable before proving control
of the corresponding private key. PublicKeyCallback may be called with
multiple keys, and the order in which the keys were provided cannot be
used to infer which key the client successfully authenticated with, if
any. Some applications, which store the key(s) passed to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions.
For example, an attacker may send public keys A and B, and then
authenticate with A. PublicKeyCallback would be called only twice, first
with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not
actually control the private key.
Since this API is widely misused, as a partial mitigation
golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the
same key, if necessary. Note that the client may still not control the
last key passed to PublicKeyCallback if the connection is then
authenticated with a different method, such as PasswordCallback,
KeyboardInteractiveCallback, or NoClientAuth.
Users should be using the Extensions field of the Permissions return
value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing
external state. Once the connection is established the state
corresponding to the successful authentication attempt can be retrieved
via the ServerConn.Permissions field. Note that some third-party
libraries misuse the Permissions type by sharing it across
authentication attempts; users of third-party libraries should refer to
the relevant projects for guidance.
```
(cherry picked from commit cbcad5c)1 parent e383db7 commit f1b883f
File tree
54 files changed
+1563
-266
lines changed- vendor
- golang.org/x
- crypto
- chacha20
- internal/poly1305
- sha3
- ssh
- sys
- cpu
- unix
- windows
- term
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
54 files changed
+1563
-266
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
36 | 36 | | |
37 | 37 | | |
38 | 38 | | |
39 | | - | |
40 | | - | |
| 39 | + | |
| 40 | + | |
41 | 41 | | |
42 | 42 | | |
43 | 43 | | |
| |||
130 | 130 | | |
131 | 131 | | |
132 | 132 | | |
133 | | - | |
| 133 | + | |
134 | 134 | | |
135 | | - | |
136 | | - | |
| 135 | + | |
| 136 | + | |
137 | 137 | | |
138 | 138 | | |
139 | 139 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
511 | 511 | | |
512 | 512 | | |
513 | 513 | | |
514 | | - | |
515 | | - | |
| 514 | + | |
| 515 | + | |
516 | 516 | | |
517 | 517 | | |
518 | 518 | | |
| |||
617 | 617 | | |
618 | 618 | | |
619 | 619 | | |
620 | | - | |
621 | | - | |
| 620 | + | |
| 621 | + | |
622 | 622 | | |
623 | 623 | | |
624 | 624 | | |
| |||
673 | 673 | | |
674 | 674 | | |
675 | 675 | | |
676 | | - | |
677 | | - | |
| 676 | + | |
| 677 | + | |
678 | 678 | | |
679 | 679 | | |
680 | 680 | | |
| |||
683 | 683 | | |
684 | 684 | | |
685 | 685 | | |
686 | | - | |
687 | | - | |
| 686 | + | |
| 687 | + | |
688 | 688 | | |
689 | 689 | | |
690 | 690 | | |
| |||
697 | 697 | | |
698 | 698 | | |
699 | 699 | | |
700 | | - | |
701 | | - | |
| 700 | + | |
| 701 | + | |
702 | 702 | | |
703 | 703 | | |
704 | 704 | | |
| |||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 86 additions & 28 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 19 additions & 11 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments