Closed dnwe closed 2 years ago
Whilst the particular CVE doesn't effect gokrb5 at all (it is in x/crypto/ssh) it has a high CVSS scoring and can hence cause false positives in applications making use of gokrb5 that pull in the older version unless they use replace directives.
replace
Sorry for taking so long to look into this. Thanks for your contribution.
@jcmturner will you be planning an 8.4.3 release in the near future?
Whilst the particular CVE doesn't effect gokrb5 at all (it is in x/crypto/ssh) it has a high CVSS scoring and can hence cause false positives in applications making use of gokrb5 that pull in the older version unless they use
replace
directives.