docker/compose
1
0
Fork 0
mirror of https://github.com/docker/compose.git synced 2026-10-12 02:13:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): golang.org/x/crypto v0.53.0

Browse Source 
golang.org/x/crypto v0.52.0 has various fixes for vulnerabilities.
These do NOT impact docker compose, but may show up in vulnerability
scanners;

    govulncheck --version
    Go: go1.26.4
    Scanner: [email protected]
    DB: https://vuln.go.dev
    DB updated: 2026-06-02 21:39:47 +0000 UTC

    govulncheck -show verbose ./...
    Fetching vulnerabilities from the database...

    Checking the code against the vulnerabilities...

    === Package Results ===

    Vulnerability #1: GO-2026-5023
        Invoking VerifiedPublicKeyCallback permissions skip enforcement in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5023
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #2: GO-2026-5020
        Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5020
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #3: GO-2026-5019
        Invoking bypass of FIDO/U2F security keys physical interaction in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5019
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #4: GO-2026-5018
        Invoking pathological RSA/DSA parameters may cause DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5018
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #5: GO-2026-5017
        Invoking client can cause server deadlock on unexpected responses in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5017
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #6: GO-2026-5016
        Invoking memory leak when rejecting channels can lead to DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5016
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #7: GO-2026-5015
        Invoking server panic during CheckHostKey/Authenticate in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5015
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #8: GO-2026-5014
        Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5014
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #9: GO-2026-5013
        Invoking byte arithmetic causes underflow and panic in

        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5013
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    === Module Results ===

    Vulnerability #1: GO-2026-5033
        Invoking pathological inputs can lead to client panic in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5033
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #2: GO-2026-5021
        Invoking auth bypass via unenforced @revoked status in
        golang.org/x/crypto/ssh/knownhosts
      More info: https://pkg.go.dev/vuln/GO-2026-5021
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #3: GO-2026-5006
        Invoking agent constraints dropped when forwarding keys in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5006
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Vulnerability #4: GO-2026-5005
        Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5005
      Module: golang.org/x/crypto
        Found in: golang.org/x/[email protected].0
        Fixed in: golang.org/x/[email protected].0

    Your code is affected by 2 vulnerabilities from 1 module.
    This scan also found 9 vulnerabilities in packages you import and 4
    vulnerabilities in modules you require, but your code doesn't appear to call
    these vulnerabilities.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
This commit is contained in:
Sebastiaan van Stijn
2026-06-15 13:22:55 +02:00
committed by Guillaume Lours
parent 0094ece2e3
commit cd4f21647d
2 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+3 -3
View File
@@ -134,10 +134,10 @@ require (
go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.51.0 // indirect
golang.org/x/crypto v0.53.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/term v0.43.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/term v0.44.0 // indirect
golang.org/x/text v0.38.0 // indirect
golang.org/x/time v0.15.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
go.sum
+8 -8
View File
@@ -411,11 +411,11 @@ go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -440,14 +440,14 @@ golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=