x/crypto: CVE-2023-39325 #65407
Labels
NeedsInvestigation
Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Security
Milestone
Comments
|
CC @golang/security |
mknyszek
added
Security
NeedsInvestigation
|
CVE-2023-39325 affects the HTTP/2 server, which is not used by x/crypto. We do not make unnecessary updates to modules to upgrade dependencies on modules which have vulnerabilities in code that is not used. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Go version
golang:1.20 container
Output of
go envin your module/workspace:What did you do?
Installed a module that uses x/crypto 0.18.0, which uses x/net 0.10.0.
What did you see happen?
This was flagged for this CVE because of the older version of x/net used by x/crypto.
What did you expect to see?
I would expect x/crypto to being using a fixed version of x/net 0.17 or newer.
The text was updated successfully, but these errors were encountered: