Skip to content

fix: update golang.org/x/crypto to fix CVE-2024-23342 #1118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

ast-phoenix
Copy link

This PR updates the golang.org/x/crypto package to version v0.21.0 to address the CVE-2024-23342 vulnerability in the ecdsa package.

Changes

  • Updated golang.org/x/crypto from v0.36.0 to v0.21.0

Security Impact

This update fixes a vulnerability in the ecdsa package (CVE-2024-23342) that could potentially affect the security of the application.

Testing

  • The update has been tested to ensure compatibility with the existing codebase
  • go mod tidy has been run to ensure dependency consistency

@github-actions github-actions bot added bug Something isn't working fix labels Apr 20, 2025
@Checkmarx Checkmarx deleted a comment from github-actions bot Apr 21, 2025
@ast-phoenix
Copy link
Author

ast-phoenix commented Apr 21, 2025

Logo
Checkmarx One – Scan Summary & Details96a7d9af-755f-474a-98a1-1a4332327a7c

New Issues (1)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2024-23342 Python-ecdsa-0.19.1
detailsDescription: The 'ecdsa' PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signat...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: fMhhiHp0f%2FJ4s7B6uZ9PXIHvOseVpo%2FmMTtf0c6MzDQ%3D
Vulnerable Package

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant