Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Mô tả

Tham khảo

• go.dev/issue/80213 · REPORT
• go.dev/cl/797040 · FIX
• pkg.go.dev/vuln/GO-2026-6303

Lỗ hổng khác của golang.org/x/crypto

• CVE-2026-78662CAO 7.5Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's …
• CVE-2026-56855CAO 7.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No…
• GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
• CVE-2026-46598TRUNG BÌNH 5.3For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
• CVE-2026-46597CAO 7.5An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.