Upgrade golang.org/x/crypto to version 0.0.0-20200220183623-bac4c82f6975 or higher.

[IzhakJakov]

Description

golang.org/x/crypto is a SSH client and server

Affected versions of this package are vulnerable to Improper Signature Verification. An attacker can craft an ssh-ed25519 or sk-ssh-...@openssh.com public key, such that the library will panic when trying to verify a signature with it. Clients can deliver such a public key and signature to any golang.org/x/crypto/ssh server with a PublicKeyCallback, and servers can deliver them to any golang.org/x/crypto/ssh client

Reference: https://security.snyk.io/vuln/SNYK-GOLANG-GOLANGORGXCRYPTO-1083910

Steps to Reproduce

〉git clone 'https://github.com/newrelic/go-agent'

〉cd go-agent/v3

〉ggdh 'golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2'
             github.com/newrelic/go-agent/v3
                            ⬇
              google.golang.org/grpc@v1.27.0
                            ⬇
   golang.org/x/net@v0.0.0-20190311183353-d8887717615a
                            ⬇
  golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2

Expected Behavior

〉git clone 'https://github.com/newrelic/go-agent'

〉cd go-agent/v3

〉ggdh 'golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2'
"golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2" is not a dependency of this package.

[RichVanderwal]

Thanks for submitting this issue, @IzhakJakov ! Thanks to your write-up its clear that this has something to do with the version of our gRPC dependency. We'll put this into our planning process.

[IzhakJakov]

Thank you.

[IzhakJakov]

What is the expected completion date for this issue?

[iamemilio]

Thanks for following up, we are short staffed right now, so this fell off the radar. I don't think its going to make this upcoming release, but it will definitely make the next one.

[iamemilio]

We will try to get this out ASAP in a micro release

[IzhakJakov]

Sounds good. Thank you!

[nr-swilloughby]

It seems this comes from the older version of grpc we have in our go.mod files. Moving grpc up to v1.39.0 updates the indirect dependency on x/net and x/crypto such that it depends on x/crypto v0.0.0-20200622213623-75b288015ac9.

[IzhakJakov]

Thanks for taking care of this :)