full diff: 69ecbb4d6d...2aa609cf4a
The cherry-pick didn't apply cleanly, so I took the single 'golang.org/x/crypto'
change in vendor.conf and re-ran vndr.
The motivation behind this is to address the input regression on Windows caused by:
6d4e4cb37c
.. and addressed in:
ecb85df213
(cherry picked from commit 37d184fe16)
Signed-off-by: Shane Jarych <sjarych@mirantis.com>
Includes 69ecbb4d6d
(forward-port of 8b5121be2f),
which fixes CVE-2020-7919:
- Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte
On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.
The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.
Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue. The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 27d9aa2d9f)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Shane Jarych
Sebastiaan van Stijn
Tibor Vass