New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2025-22869 golang.org/x/crypto bump version #2270

Open

irlndts wants to merge 1 commit into jackc:master from irlndts:CVE-2025-22869

irlndts commented Mar 5, 2025 •

edited

Loading

Hi, there is a vulnerability CVE-2025-22869

I know pgx actually doesn't use the vulnerable functionality in golang.org/x/crypto but scanner alert still works.

I've done followings:

Update go.mod to bump crypto version to v0.35.0
Update go version to 1.24 since crypto v0.35.0 requires it
Then go mod tidy
Then go test ./... (everything is fine)


          CVE-2025-22869 golang.org/x/crypto bump version

88f8a75

irlndts force-pushed the CVE-2025-22869 branch from 15801e4 to 88f8a75 Compare

March 5, 2025 14:06

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet