VDB
KO
CRITICAL 9.1

GHSA-5cgq-3rg8-m6cv

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Quick fix

GHSA-5cgq-3rg8-m6cv — golang.org/x/crypto: upgrade to the fixed version with the command below. 

go get golang.org/x/crypto@v0.52.0

Details

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / golang.org/x/crypto
Introduced in: 0 Fixed in: 0.52.0
Fix go get golang.org/x/crypto@v0.52.0

References