golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-46595 · ADVISORY
• nvd.nist.gov/vuln/detail/CVE-2024-45337 · ADVISORY
• security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json · WEB
• pkg.go.dev/vuln/GO-2026-5023 · WEB
• groups.google.com/g/golang-announce/c/a082jnz-LvI · WEB
• go.dev/issue/79570 · WEB
• go.dev/cl/781642 · WEB
• cs.opensource.google/go/x/crypto · PACKAGE
• bugzilla.redhat.com/show_bug.cgi · WEB
• access.redhat.com/security/cve/CVE-2026-46595 · WEB
• access.redhat.com/errata/RHSA-2026:41036 · WEB
• access.redhat.com/errata/RHSA-2026:41019 · WEB
• access.redhat.com/errata/RHSA-2026:40945

golang.org/x/crypto のその他の脆弱性

• CVE-2026-78662高 7.5Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's …
• CVE-2026-56855高 7.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No…
• CVE-2026-56854高 7.5The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and…
• GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
• CVE-2026-46598中 5.3For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.