Skip to content

Bump golang.org/x/crypto to v0.31.0 to address CVE-2024-45337 #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

Copilot
Copy link

@Copilot Copilot AI commented Jun 2, 2025

This PR updates golang.org/x/crypto from v0.24.0 to v0.31.0 to address CVE-2024-45337. While the vulnerability specifically affects the SSH module in x/crypto (which this project doesn't use), updating to a newer version helps satisfy security scanners and keeps dependencies current.

Changes Made

  • Updated golang.org/x/crypto from v0.24.0 to v0.31.0
  • Updated transitive dependencies:
    • golang.org/x/sys from v0.21.0 to v0.28.0
    • golang.org/x/text from v0.16.0 to v0.21.0

Impact Assessment

This project only uses two packages from golang.org/x/crypto:

  • golang.org/x/crypto/md4 in the NTLM authentication module
  • golang.org/x/crypto/pkcs12 in the local certificate key provider

Neither of these packages are related to SSH functionality, so the CVE does not affect this codebase. The update is purely to address security scanner warnings.

Testing

  • ✅ Project builds successfully
  • ✅ All crypto-related tests pass (NTLM, localcert, always-encrypted)
  • ✅ No breaking changes detected

Fixes #265.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

  • nonexistant-dns.svc.cluster.local
  • server.database.windows.net
    • Triggering command: /tmp/go-build2996761874/b259/go-mssqldb.test -test.testlogfile=/tmp/go-build2996761874/b259/testlog.txt -test.paniconexit0 -test.timeout=30s (dns block)

If you need me to access, download, or install something from one of these locations, you can either:


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Copilot AI and others added 2 commits June 2, 2025 14:06
Co-authored-by: shueybubbles <2224906+shueybubbles@users.noreply.github.com>
Co-authored-by: shueybubbles <2224906+shueybubbles@users.noreply.github.com>
@Copilot Copilot AI changed the title [WIP] Bumping x/crypto to 0.31.0 Bump golang.org/x/crypto to v0.31.0 to address CVE-2024-45337 Jun 2, 2025
@Copilot Copilot AI requested a review from shueybubbles June 2, 2025 14:09
Copilot finished work on behalf of shueybubbles June 2, 2025 14:09
@shueybubbles shueybubbles marked this pull request as ready for review June 2, 2025 15:52
@codecov-commenter
Copy link

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.02%. Comparing base (d3c6336) to head (309fbb0).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #266      +/-   ##
==========================================
- Coverage   75.11%   75.02%   -0.10%     
==========================================
  Files          32       32              
  Lines        6471     6471              
==========================================
- Hits         4861     4855       -6     
- Misses       1325     1328       +3     
- Partials      285      288       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Bumping x/crypto to 0.31.0
3 participants