Upgrade golang.org/x/crypto to version 0.0.0-20200220183623-bac4c82f6975 or higher.

[IzhakJakov]

Description

golang.org/x/crypto is a SSH client and server

Affected versions of this package are vulnerable to Improper Signature Verification. An attacker can craft an ssh-ed25519 or [email protected] public key, such that the library will panic when trying to verify a signature with it. Clients can deliver such a public key and signature to any golang.org/x/crypto/ssh server with a PublicKeyCallback, and servers can deliver them to any golang.org/x/crypto/ssh client

Reference: https://security.snyk.io/vuln/SNYK-GOLANG-GOLANGORGXCRYPTO-1083910

Steps to Reproduce

〉git clone 'https://github.com/newrelic/go-agent'

〉cd go-agent/v3

〉ggdh 'golang.org/x/[email protected]'
             github.com/newrelic/go-agent/v3
                            ⬇
              google.golang.org/[email protected]
                            ⬇
   golang.org/x/[email protected]
                            ⬇
  golang.org/x/[email protected]

Expected Behavior

〉git clone 'https://github.com/newrelic/go-agent'

〉cd go-agent/v3

〉ggdh 'golang.org/x/[email protected]'
"golang.org/x/[email protected]" is not a dependency of this package.

[RichVanderwal]

Thanks for submitting this issue, @IzhakJakov ! Thanks to your write-up its clear that this has something to do with the version of our gRPC dependency. We'll put this into our planning process.

[IzhakJakov]

Thank you.

[IzhakJakov]

What is the expected completion date for this issue?

[iamemilio]

Thanks for following up, we are short staffed right now, so this fell off the radar. I don't think its going to make this upcoming release, but it will definitely make the next one.

[iamemilio]

We will try to get this out ASAP in a micro release

[IzhakJakov]

Sounds good. Thank you!

[nr-swilloughby]

It seems this comes from the older version of grpc we have in our go.mod files. Moving grpc up to v1.39.0 updates the indirect dependency on x/net and x/crypto such that it depends on x/crypto v0.0.0-20200622213623-75b288015ac9.

[IzhakJakov]

Thanks for taking care of this :)