Bump golang.org/x/crypto to v0.55.0 for CVE-2026-56854 - #266
Open
ai-collaboration-app[bot] wants to merge 1 commit into
Open
Bump golang.org/x/crypto to v0.55.0 for CVE-2026-56854#266ai-collaboration-app[bot] wants to merge 1 commit into
ai-collaboration-app[bot] wants to merge 1 commit into
Conversation
The advisory concerns the source-address critical option in x/crypto/ssh. That package is not linked — go list -deps ./cmd/... resolves 1335 packages and the only module packages present are ocsp, pbkdf2 and scrypt — so the option is unreachable here. Bumping anyway because a compatible fixed version exists, which makes this cheaper and more durable than another suppression. go get pulled the coupled golang.org/x upgrades it needs: mod, net, term, text and tools. All six modules are indirect and no direct dependency moved. Unaffected: GO-2026-5932 covers every version of the module because the openpgp packages are unmaintained, so this bump does not clear it and the exception plus its new reachability check both still apply. CVE ticket: StackVista/cve-reporter#69 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
golang.org/x/cryptofromv0.53.0tov0.55.0, clearing CVE-2026-56854 (source-addresscritical option inx/crypto/ssh; High per Grype, UNKNOWN per Trivy).x/crypto/sshis not linked —go list -deps ./cmd/...resolves 1335 packages and the only module packages present areocsp,pbkdf2andscrypt— so the option is unreachable. Bumping rather than suppressing because a compatible fixed version exists.go getpulled the coupledgolang.org/xupgrades it requires:mod,net,term,text,tools. All six are indirect; no direct dependency moved.This does not touch GO-2026-5932, which covers every version of the module and stays suppressed by
exceptions/GO-2026-5932.yaml— see #264 and cve-reporter#27.Two coupled consequences worth knowing before merge. The vexhub statement for GO-2026-5932 pins its subcomponent to
pkg:golang/golang.org/x/crypto@v0.53.0, so it must move tov0.55.0or it cannot match this image even once cve-reporter#27 fixes the identity gap. And the local exception is already lapsed on master — this PR's own run reportsexpired: 1, suppressed: 0— so #264 is what restores the suppression.Reviewer note: the 45 openssl findings this repo's CI now reports are not addressed here and cannot be from this repo —
SLE_BCIhas not synced the fixed build (cve-reporter#66). CI passes them becausemode: informlanded in #265.CVE ticket: https://github.com/StackVista/cve-reporter/issues/69. Finding revision
sha256:06f35b2f711ad3c57bc5c07be5174540c7a9a922b6a5d8b0416c8e329ef4e6e0.