Skip to content

[Aikido] Fix security issue in x/crypto via minor version upgrade from 0.52.0 to 0.55.0 - #115

Draft
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-MAINT-1572-update-packages-100848056-fyt2
Draft

[Aikido] Fix security issue in x/crypto via minor version upgrade from 0.52.0 to 0.55.0#115
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-MAINT-1572-update-packages-100848056-fyt2

Conversation

@aikido-autofix

Copy link
Copy Markdown
Contributor

Upgrade golang.org/x/crypto to enforce source-address restrictions across all authentication callbacks, fixing permission bypass vulnerability.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-56854
HIGH
[golang.org/x/crypto] Source-address restrictions in authentication callbacks were not enforced for password, keyboard-interactive, and other non-public-key authentication methods, allowing attackers to bypass IP-based access controls. The vulnerability has been fixed to validate source-address permissions across all authentication callback types.
🔗 Related Tasks

@aikido-autofix aikido-autofix Bot added the aikido Label created by Aikido AutoFix label Aug 30, 2026
@theplant-ci

Copy link
Copy Markdown

Hi @aikido-autofix[bot]. Thanks for your PR.

PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test all.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aikido Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant