Sebastiaan van Stijn
1edb10fe30
full diff: https://github.com/golang/crypto/compare/1d94cc7ab1c630336ab82ccb9c9cda72a875c382...bac4c82f69751a6dd76e702d54b3ceb88adab236 Version v0.0.0-20200220183623-bac4c82f6975 of golang.org/x/crypto fixes a vulnerability in the golang.org/x/crypto/ssh package which allowed peers to cause a panic in SSH servers that accept public keys and in any SSH client. An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public key, such that the library will panic when trying to verify a signature with it. Clients can deliver such a public key and signature to any golang.org/x/crypto/ssh server with a PublicKeyCallback, and servers can deliver them to any golang.org/x/crypto/ssh client. This issue was discovered and reported by Alex Gaynor, Fish in a Barrel, and is tracked as CVE-2020-9283. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>