Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
29 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go golang.org/x/crypto < 0.0.0-20190320223903-b7391e95e576
Fixed in
0.0.0-20190320223903-b7391e95e576· Vendor fix available
Issue
An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications. Specific Go Packages Affected golang.org/x/crypto/salsa20/salsa
Recommended action: Upgrade to 0.0.0-20190320223903-b7391e95e576 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go golang.org/x/crypto < 0.0.0-20220314234659-1baeb1ce4c0b
Fixed in
0.0.0-20220314234659-1baeb1ce4c0b· Vendor fix available
Issue
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Recommended action: Upgrade to 0.0.0-20220314234659-1baeb1ce4c0b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go golang.org/x/crypto < 0.0.0-20200124225646-8b5121be2f68
Fixed in
0.0.0-20200124225646-8b5121be2f68· Vendor fix available
Issue
The Helm core maintainers have identified a high severity security vulnerability in Go's crypto package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0. Thanks to @ravin9249 for identifying the vulnerability. Impact Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service. Patches A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+. Workarounds No workaround is available. Users are urged to upgrade. References - https://nvd.nist.gov/vuln/detail/CVE-2020-7919 - https://github.com/helm/helm/pull/8288 For more information If you have any questions or comments about this advisory: Open an issue in the Helm repository For security-specific issues, email us at…
Recommended action: Upgrade to 0.0.0-20200124225646-8b5121be2f68 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go golang.org/x/crypto < 0.0.0-20200220183623-bac4c82f6975
Fixed in
0.0.0-20200220183623-bac4c82f6975· Vendor fix available
Issue
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Recommended action: Upgrade to 0.0.0-20200220183623-bac4c82f6975 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.