Repository navigation
chore(deps): Update test/integration security deps [SECURITY] - #279
renovate-bot wants to merge 1 commit into
Conversation
ℹ️ Artifact update noticeFile name: test/integration/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: renovate-bot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @renovate-bot. Thanks for your PR. I'm waiting for a GoogleCloudPlatform member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/ok-to-test |
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v1.1.0→v1.1.1v1.6.7→v1.7.8v1.44.0→v1.65.0v1.69.0→v1.88.5v1.69.0→v1.97.3v1.5.0→v1.5.3v5.7.1→v5.9.2v0.5.0→v0.5.1v0.36.0→v0.52.0v0.38.0→v0.55.0v0.24.0→v0.27.0filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity
CVE-2026-26958 / GHSA-fw7p-63qq-7hpr
More information
Details
(*Point).MultiScalarMultfailed to initialize its receiver.If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.
If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.
Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on
filippo.io/edwards25519viagithub.com/go-sql-driver/mysql, you are not affected. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like govulncheck.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
GHSA-xmrv-pmrh-hhx2
More information
Details
CVSSv3.1 Rating: [Medium]
CVSSv3.1 Score: [5.9]
CVSSv3.1 Vector String: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]
Summary and Impact
An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.
Impacted versions: < 2026-03-23
Patches
This issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Not Applicable
References
If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
GHSA-w67g-5rqw-f597
More information
Details
gorilla/websocket used
math/rand(cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with a known value, enabling an attacker to predict or recover mask keys and inject content into WebSocket connections.Type: Use of Cryptographically Weak Pseudo-Random Number Generator
Fix: Replaced math/rand with crypto/rand (commit d67f4185, released in v1.5.3)
Credit: bounty-hunter v6.0 silent-fix detection
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Memory-safety vulnerability in github.com/jackc/pgx/v5.
CVE-2026-33816 / GHSA-9jj7-4m8r-rfcm
More information
Details
Memory-safety vulnerability in github.com/jackc/pgx/v5.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
pgx: SQL Injection via placeholder confusion with dollar quoted string literals
CVE-2026-41889 / GHSA-j88v-2chj-qfwx
More information
Details
Impact
SQL Injection can occur when:
e.g.
This is unlikely to occur outside of a contrived scenario.
Patches
The problem is resolved in v5.9.2.
Workarounds
Do not use the simple protocol to execute queries matching all the above conditions.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
pgx contains memory-safety vulnerability
CVE-2026-33815 / GHSA-xgrm-4fwx-7qm8
More information
Details
pgx is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SpdyStream: DOS on CRI
CVE-2026-35469 / GHSA-pc3f-x583-g7j2
More information
Details
The SPDY/3 frame parser in spdystream does not validate
attacker-controlled counts and lengths before allocating memory. A
remote peer that can send SPDY frames to a service using spdystream can
cause the process to allocate gigabytes of memory with a small number of
malformed control frames, leading to an out-of-memory crash.
Three allocation paths in the receive side are affected:
numSettingsfrom the payload and allocates a slice of that sizewithout checking it against the declared frame length. An attacker
can set
numSettingsto a value far exceeding the actual payload,triggering a large allocation before any setting data is read.
parseHeaderValueBlockreads a 32-bitnumHeadersfrom the decompressed header block and allocates anhttp.Headermap of that size with no upper bound.read as 32-bit integers and used directly as allocation sizes with
no validation.
Because SPDY header blocks are zlib-compressed, a small on-the-wire
payload can decompress into attacker-controlled bytes that the parser
interprets as 32-bit counts and lengths. A single crafted frame is
enough to exhaust process memory.
Impact
Any program that accepts SPDY connections using spdystream -- directly
or through a dependent library -- is affected. A remote peer that can
send SPDY frames to the service can crash the process with a single
crafted SPDY control frame, causing denial of service.
Affected versions
github.com/moby/spdystream<= v0.5.0Fix
v0.5.1 addresses the receive-side allocation bugs and adds related
hardening:
Core fixes:
checks that
numSettingsis consistent with the declared framelength (
numSettings <= (length-4)/8) before allocating.parseHeaderValueBlockenforces a maximumnumber of headers per frame (default: 1000).
lengths are checked against a per-field size limit (default: 1 MiB)
before allocation.
now closes the underlying
net.Connwhen it encounters anInvalidControlFrameerror, preventing further exploitation on thesame connection.
Additional hardening:
that payloads fit within the 24-bit length field, preventing the
library from producing invalid frames.
Configurable limits:
NewConnectionWithOptionsorthe lower-level
spdy.NewFramerWithOptionswith functional options:WithMaxControlFramePayloadSize,WithMaxHeaderFieldSize, andWithMaxHeaderCount.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x
More information
Details
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv
More information
Details
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
CVE-2026-46595 / GHSA-x527-x647-q7gg
More information
Details
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
CVE-2026-42508 / GHSA-5cgq-3rg8-m6cv
More information
Details
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
CVE-2026-46597 / GHSA-q4h4-gmj2-qvw2
More information
Details
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
CVE-2026-39828 / GHSA-45gg-vh54-h5m9
More information
Details
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
CVE-2026-39831 / GHSA-89gr-r52h-f8rx
More information
Details
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
CVE-2026-39829 / GHSA-w879-237q-wc7r
More information
Details
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto doesn't enforce invoking key constraints
CVE-2026-39833 / GHSA-jppx-rxg9-jmrx
More information
Details
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking pathological inputs can lead to client panic
CVE-2026-46598 / GHSA-9m57-25v3-79x9
More information
Details
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
CVE-2026-39830 / GHSA-vgwf-h737-ff37
More information
Details
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HReferences