GHSA-f5wc-c3c7-36mc
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-39832
- Alias
- GO-2026-5006
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.52.0 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-39832 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:35833 WEB
- https://access.redhat.com/errata/RHSA-2026:41036 WEB
- https://access.redhat.com/errata/RHSA-2026:41066 WEB
- https://access.redhat.com/errata/RHSA-2026:42146 WEB
- https://access.redhat.com/errata/RHSA-2026:42796 WEB
- https://access.redhat.com/errata/RHSA-2026:43052 WEB
- https://access.redhat.com/errata/RHSA-2026:43692 WEB
- https://access.redhat.com/errata/RHSA-2026:49944 WEB
- https://access.redhat.com/errata/RHSA-2026:52857 WEB
- https://access.redhat.com/errata/RHSA-2026:52910 WEB
- https://access.redhat.com/security/cve/CVE-2026-39832 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2480685 WEB
- https://cs.opensource.google/go/x/crypto PACKAGE
- https://go.dev/cl/778642 WEB
- https://go.dev/issue/79435 WEB
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI WEB
- https://pkg.go.dev/vuln/GO-2026-5006 WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json WEB
- https://access.redhat.com/errata/RHSA-2026:36199 WEB
- https://access.redhat.com/errata/RHSA-2026:36319 WEB
- https://access.redhat.com/errata/RHSA-2026:36625 WEB
- https://access.redhat.com/errata/RHSA-2026:36648 WEB
- https://access.redhat.com/errata/RHSA-2026:36651 WEB
- https://access.redhat.com/errata/RHSA-2026:36796 WEB
- https://access.redhat.com/errata/RHSA-2026:36797 WEB
- https://access.redhat.com/errata/RHSA-2026:37072 WEB
- https://access.redhat.com/errata/RHSA-2026:37123 WEB
- https://access.redhat.com/errata/RHSA-2026:37271 WEB
- https://access.redhat.com/errata/RHSA-2026:37387 WEB
- https://access.redhat.com/errata/RHSA-2026:37410 WEB
- https://access.redhat.com/errata/RHSA-2026:40118 WEB
- https://access.redhat.com/errata/RHSA-2026:40262 WEB
- https://access.redhat.com/errata/RHSA-2026:40945 WEB
- https://access.redhat.com/errata/RHSA-2026:40972 WEB
- https://access.redhat.com/errata/RHSA-2026:41019 WEB
- https://access.redhat.com/errata/RHSA-2026:41031 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |