Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: golang/crypto
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v0.30.0
Choose a base ref
...
head repository: golang/crypto
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v0.31.0
Choose a head ref
  • 1 commit
  • 2 files changed
  • 1 contributor

Commits on Dec 11, 2024

  1. ssh: make the public key cache a 1-entry FIFO cache 

    Users of the the ssh package seem to extremely commonly misuse the
PublicKeyCallback API, assuming that the key passed in the last call
before a connection is established is the key used for authentication.
Some users then make authorization decisions based on this key. This
property is not documented, and may not be correct, due to the caching
behavior of the package, resulting in users making incorrect
authorization decisions about the connection.

This change makes the cache a one entry FIFO cache, making the assumed
property, that the last call to PublicKeyCallback represents the key
actually used for authentication, actually hold.

Thanks to Damien Tournoud, Patrick Dawkins, Vince Parker, and
Jules Duvivier from the Platform.sh / Upsun engineering team
for reporting this issue.

Fixes golang/go#70779
Fixes CVE-2024-45337

Change-Id: Ife7c7b4045d8b6bcd7e3a417bdfae370c709797f
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/635315
Reviewed-by: Roland Shoemaker <[email protected]>
Auto-Submit: Gopher Robot <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Reviewed-by: Nicola Murino <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
    @rolandshoemaker @gopherbot
    rolandshoemaker authored and gopherbot committed Dec 11, 2024
    Configuration menu
    Copy the full SHA
    b4f1988 View commit details
    Browse the repository at this point in the history
Loading