fix: bump golang.org/x/crypto to v0.57.0 and suppress GO-2026-5932 - #276
Open
marcusburghardt wants to merge 1 commit into
Open
marcusburghardt wants to merge 1 commit into
marcusburghardt wants to merge 1 commit into
Conversation
Resolve code-scanning alert complytime#52 by upgrading golang.org/x/crypto from v0.55.0 to v0.57.0, which fixes CVE-2026-78662 (SSH DoS via undecided channel deadlock) and CVE-2026-56855 (SSH DoS via established channel deadlock). Add osv-scanner.toml to suppress GO-2026-5932 (deprecated openpgp package). This advisory has no fixed version because the package is permanently unmaintained. complypack does not import openpgp; the module is a transitive dependency pulled in by OPA, Regal, and JWX for x/crypto/pbkdf2 only. govulncheck confirms zero reachable vulnerabilities. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
marcusburghardt
force-pushed
the
fix/bump-x-crypto-v0.57.0
branch
from
September 21, 2026 14:17
c4ddf37 to
f802671
Compare
marcusburghardt
enabled auto-merge
September 21, 2026 14:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolve code-scanning alert #52 by addressing 3 known vulnerabilities in the transitive dependency
golang.org/x/crypto v0.55.0.Vulnerabilities Addressed
x/crypto/sshv0.57.0x/crypto/sshv0.57.0x/crypto/openpgposv-scanner.tomlThis also resolves Trivy alerts #102 and #103 (same SSH CVEs).
Changes
go.mod/go.sumBump
golang.org/x/cryptofromv0.55.0tov0.57.0. This fixes both SSH DoS vulnerabilities (CVE-2026-78662 and CVE-2026-56855).osv-scanner.toml(new file)Suppress GO-2026-5932 with documented rationale. This advisory flags the deprecated
golang.org/x/crypto/openpgppackage, which:x/cryptomodulegovulncheckandgo list -deps ./...x/cryptosub-packages actually compiled arepbkdf2(JWX),chacha20,chacha20poly1305, andcryptobyte(Go stdlib vendored)Since every version of
golang.org/x/cryptois flagged by this advisory (introduced=0, fixed=N/A), suppression viaosv-scanner.tomlis the only viable approach. This is the documented method for non-applicable transitive advisories.Verification
go build ./...— passesgo test -race ./...— all 22 packages passgovulncheck ./...— SSH CVEs resolved; reports 0 reachable vulnerabilitiesgitleaks detect— no leaks foundNote on Scorecard
The Scorecard "Vulnerabilities" check queries the OSV API directly and does not read
osv-scanner.toml. After merging, the Scorecard score should improve (2 of 3 vulns fixed), but may still report GO-2026-5932. This is an accepted upstream limitation affecting every Go project that transitively depends ongolang.org/x/crypto.