p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in golang-go.crypto

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für golang-go.crypto: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 14

  1. CVE-2026-56854

    Hoch · CVSS 7.5EPSS 0,44%Keine Korrektur veröffentlicht

    Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

    The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

    golang-go.cryptoBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-39829

    Hoch · CVSS 7.5EPSS 0,47%Keine Korrektur veröffentlicht

    Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

    The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

    golang-go.cryptoBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-39827

    Mittel · CVSS 6.5EPSS 0,28%Keine Korrektur veröffentlicht

    Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

    An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

    golang-go.cryptoBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-39835

    Mittel · CVSS 5.3EPSS 0,5%Keine Korrektur veröffentlicht

    Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

    golang-go.cryptoBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-39828

    Mittel · CVSS 6.3EPSS 0,37%Keine Korrektur veröffentlicht

    Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

    When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

    golang-go.cryptoBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2024-45341

    Mittel · CVSS 6.1EPSS 0,57%Keine Korrektur veröffentlicht

    Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

    A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

    golang-go.cryptoBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2023-48795

    Mittel · CVSS 5.9EPSS 93,55%Öffentlicher ExploitKeine Korrektur veröffentlicht

    CVE-2023-48795

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with E

    golang-go.cryptoBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →