6a0099bc8a
Hello gophers, We have tagged version v0.45.0 of golang.org/x/crypto in order to address two security issues. This version fixes a vulnerability in the golang.org/x/crypto/ssh package and a vulnerability in the golang.org/x/crypto/ssh/agent package which could cause programs to consume unbounded memory or panic respectively. SSH servers parsing GSSAPI authentication requests don't validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. Thanks to Jakub Ciolek for reporting this issue. This is CVE-2025-58181 and Go issue https://go.dev/issue/76363. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. Thanks to Jakub Ciolek for reporting this issue. This is CVE-2025-47914 and Go issue https://go.dev/issue/76364. Cheers, Go Security team Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
81 lines
3.6 KiB
Modula-2
81 lines
3.6 KiB
Modula-2
module github.com/docker/cli/cmd/docker-trust
|
|
|
|
go 1.24.0
|
|
|
|
require (
|
|
github.com/containerd/errdefs v1.0.0
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/docker/cli v29.0.4+incompatible
|
|
github.com/docker/cli-docs-tool v0.10.0
|
|
github.com/docker/distribution v2.8.3+incompatible
|
|
github.com/docker/go-connections v0.6.0
|
|
github.com/fvbommel/sortorder v1.1.0
|
|
github.com/moby/moby/api v1.52.0
|
|
github.com/moby/moby/client v0.1.0
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/spf13/cobra v1.10.1
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/theupdateframework/notary v0.7.1-0.20210315103452-bf96a202a09a
|
|
go.opentelemetry.io/otel v1.38.0
|
|
gotest.tools/v3 v3.5.2
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cloudflare/cfssl v1.6.4 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/containerd/platforms v1.0.0-rc.1 // indirect
|
|
github.com/docker/docker-credential-helpers v0.9.4 // indirect
|
|
github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
|
|
github.com/docker/go-metrics v0.0.1 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/gorilla/mux v1.8.1 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/mattn/go-runewidth v0.0.17 // indirect
|
|
github.com/miekg/pkcs11 v1.1.1 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/sys/atomicwriter v0.1.0 // indirect
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
github.com/moby/term v0.5.2 // indirect
|
|
github.com/morikuni/aec v1.0.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/prometheus/client_golang v1.22.0 // indirect
|
|
github.com/prometheus/client_model v0.6.1 // indirect
|
|
github.com/prometheus/common v0.62.0 // indirect
|
|
github.com/prometheus/procfs v0.15.1 // indirect
|
|
github.com/rivo/uniseg v0.2.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.38.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
|
|
golang.org/x/crypto v0.45.0 // indirect
|
|
golang.org/x/net v0.47.0 // indirect
|
|
golang.org/x/sys v0.38.0 // indirect
|
|
golang.org/x/term v0.37.0 // indirect
|
|
golang.org/x/text v0.31.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
|
|
google.golang.org/grpc v1.75.0 // indirect
|
|
google.golang.org/protobuf v1.36.9 // indirect
|
|
k8s.io/klog/v2 v2.90.1 // indirect
|
|
)
|