search

FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
https://age-encryption.org
BSD 3-Clause "New" or "Revised" License
15.79k stars 477 forks source link

Fix CVE-2022-27191 #409

Closed deryoman closed 2 years ago

deryoman commented 2 years ago

Update x/crypto to latest version to fix CVE-2022-27191 in age and age-keygen

deryoman commented 2 years ago

Hey there, unfortunately I do not have a FreeBSD box at hand to test. The failure seems to be infrastructure related, the FreeBSD runner is apparently missing the git executable:

go: missing Git command. See https://golang.org/s/gogetcmd

Could anybody jump in here? :)

FiloSottile commented 2 years ago

Hi, CVE-2022-27191 does not affect age at all. It's a crash in the SSH server when using custom Signers. We only use key serialization and deserialization from golang.org/x/crypto/ssh. Vulnerability scanners that indiscriminately flag any vulnerability in a dependency are a problem, because they reduce the signal to noise ratio, and take attention away from actual vulnerabilities, training projects to just blindly merge fixes without doing the research of "how does this impact my users and should we tell them".