Update module golang.org/x/crypto to v0.35.0 [SECURITY] #113

bootc-bot · 2025-09-05T12:18:05Z

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	`v0.28.0` -> `v0.35.0`

GitHub Vulnerability Alerts

CVE-2024-45337

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

CVE-2025-22869

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

bootc-bot · 2025-09-05T12:18:06Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.22.6` -> `1.23.0`
`golang.org/x/sys`	`v0.26.0` -> `v0.30.0`
`golang.org/x/term`	`v0.25.0` -> `v0.29.0`
`golang.org/x/sync`	`v0.8.0` -> `v0.11.0`
`golang.org/x/text`	`v0.19.0` -> `v0.22.0`

bootc-bot · 2025-09-05T13:16:46Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>

bootc-bot · 2025-11-10T16:14:06Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module golang.org/x/[email protected] requires go >= 1.23.0; switching to go1.24.10
go: downloading github.com/containers/common v0.58.1
go: downloading github.com/containers/podman/v5 v5.0.1
go: downloading github.com/distribution/reference v0.5.0
go: downloading github.com/spf13/cobra v1.8.0
go: downloading golang.org/x/sys v0.30.0
go: downloading golang.org/x/term v0.29.0
go: downloading github.com/gofrs/flock v0.8.1
go: downloading github.com/containers/gvisor-tap-vsock v0.7.3
go: downloading github.com/onsi/ginkgo/v2 v2.17.1
go: downloading golang.org/x/crypto v0.35.0
go: downloading github.com/onsi/gomega v1.32.0
go: downloading github.com/containers/storage v1.53.0
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/containers/buildah v1.35.3
go: downloading github.com/containers/image/v5 v5.30.0
go: downloading github.com/docker/docker v25.0.3+incompatible
go: downloading github.com/containers/ocicrypt v1.1.9
go: downloading github.com/opencontainers/image-spec v1.1.0
go: downloading github.com/opencontainers/runtime-spec v1.2.0
go: downloading github.com/moby/sys/user v0.1.0
go: downloading github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
go: downloading github.com/moby/term v0.5.0
go: downloading golang.org/x/net v0.30.0
go: downloading github.com/Microsoft/go-winio v0.6.1
go: downloading github.com/shirou/gopsutil/v3 v3.24.2
go: downloading github.com/go-logr/logr v1.4.1
go: downloading github.com/google/go-cmp v0.6.0
go: downloading github.com/BurntSushi/toml v1.3.2
go: downloading github.com/cyphar/filepath-securejoin v0.2.4
go: downloading github.com/opencontainers/runtime-tools v0.9.1-0.20230914150019-408c51e934dc
go: downloading github.com/klauspost/compress v1.17.7
go: downloading github.com/ulikunitz/xz v0.5.11
go: downloading golang.org/x/exp v0.0.0-20240222234643-814bf88cf225
go: downloading sigs.k8s.io/yaml v1.4.0
go: downloading github.com/opencontainers/selinux v1.11.0
go: downloading tags.cncf.io/container-device-interface v0.6.2
go: downloading github.com/pkg/sftp v1.13.6
go: downloading github.com/opencontainers/runc v1.1.12
go: downloading golang.org/x/sync v0.11.0
go: downloading github.com/moby/sys/mountinfo v0.7.1
go: downloading github.com/gorilla/schema v1.2.1
go: downloading github.com/crc-org/crc/v2 v2.32.0
go: downloading github.com/vbauerster/mpb/v8 v8.7.2
go: downloading golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
go: downloading github.com/crc-org/vfkit v0.5.1
go: downloading github.com/containers/libhvee v0.7.0
go: downloading github.com/digitalocean/go-qemu v0.0.0-20230711162256-2e3d0186973e
go: downloading golang.org/x/text v0.22.0
go: downloading github.com/docker/docker-credential-helpers v0.8.1
go: downloading github.com/tklauser/go-sysconf v0.3.12
go: downloading github.com/containerd/containerd v1.7.13
go: downloading github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466
go: downloading github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161
go: downloading github.com/openshift/imagebuilder v1.2.6
go: downloading github.com/proglottis/gpgme v0.1.3
go: downloading github.com/sigstore/fulcio v1.4.3
go: downloading github.com/sigstore/sigstore v1.8.2
go: downloading github.com/mattn/go-runewidth v0.0.15
go: downloading github.com/gin-gonic/gin v1.10.0
go: downloading github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980
go: downloading github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0
go: downloading github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c
go: downloading github.com/shoenig/go-m1cpu v0.1.6
go: downloading github.com/tklauser/numcpus v0.6.1
go: downloading github.com/vbatts/tar-split v0.11.5
go: downloading github.com/fsnotify/fsnotify v1.7.0
go: downloading github.com/fsouza/go-dockerclient v1.10.1
go: downloading github.com/moby/buildkit v0.12.5
go: downloading github.com/secure-systems-lab/go-securesystemslib v0.8.0
go: downloading github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f
go: downloading github.com/sigstore/rekor v1.2.2
go: downloading dario.cat/mergo v1.0.0
go: downloading github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f
go: downloading github.com/sylabs/sif/v2 v2.15.1
go: downloading github.com/mattn/go-colorable v0.1.13
go: downloading gopkg.in/natefinch/lumberjack.v2 v2.2.1
go: downloading github.com/gin-contrib/sse v0.1.0
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/letsencrypt/boulder v0.0.0-20230907030200-6d76a0f91e1e
go: downloading github.com/google/pprof v0.0.0-20230323073829-e72429f035bd
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0
go: downloading go.opentelemetry.io/otel/trace v1.22.0
go: downloading go.opentelemetry.io/otel v1.22.0
go: downloading github.com/containerd/stargz-snapshotter/estargz v0.15.1
go: downloading github.com/tchap/go-patricia/v2 v2.3.1
go: downloading github.com/Microsoft/hcsshim v0.12.0-rc.3
go: downloading github.com/cilium/ebpf v0.11.0
go: downloading golang.org/x/time v0.3.0
go: downloading github.com/mattn/go-sqlite3 v1.14.22
go: downloading github.com/google/go-containerregistry v0.19.0
go: downloading google.golang.org/grpc v1.61.0
go: downloading github.com/go-jose/go-jose/v3 v3.0.3
go: downloading go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
go: downloading github.com/moby/patternmatcher v0.6.0
go: downloading golang.org/x/mod v0.17.0
go: downloading github.com/go-playground/validator/v10 v10.22.1
go: downloading github.com/pelletier/go-toml/v2 v2.2.3
go: downloading github.com/ugorji/go/codec v1.2.12
go: downloading google.golang.org/protobuf v1.35.1
go: downloading github.com/bytedance/sonic v1.12.3
go: downloading github.com/goccy/go-json v0.10.3
go: downloading go.opentelemetry.io/otel/metric v1.22.0
go: downloading github.com/go-openapi/errors v0.21.1
go: downloading github.com/go-openapi/runtime v0.26.0
go: downloading github.com/go-openapi/strfmt v0.22.2
go: downloading github.com/go-openapi/swag v0.22.10
go: downloading github.com/go-openapi/validate v0.22.1
go: downloading github.com/golang/protobuf v1.5.3
go: downloading github.com/moby/sys/sequential v0.5.0
go: downloading github.com/containerd/typeurl/v2 v2.1.1
go: downloading github.com/gabriel-vasile/mimetype v1.4.6
go: downloading github.com/go-playground/universal-translator v0.18.1
go: downloading github.com/leodido/go-urn v1.4.0
go: downloading gopkg.in/go-jose/go-jose.v2 v2.6.3
go: downloading github.com/mattn/go-shellwords v1.0.12
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20231212172506-995d672761c0
go: downloading github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
go: downloading github.com/mitchellh/mapstructure v1.5.0
go: downloading github.com/oklog/ulid v1.3.1
go: downloading go.mongodb.org/mongo-driver v1.14.0
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading github.com/go-openapi/analysis v0.21.4
go: downloading github.com/go-openapi/jsonpointer v0.19.6
go: downloading github.com/go-openapi/loads v0.21.2
go: downloading github.com/go-openapi/spec v0.20.9
go: downloading github.com/go-playground/locales v0.14.1
go: downloading github.com/josharian/intern v1.0.0
go: downloading github.com/go-openapi/jsonreference v0.20.2
go: downloading github.com/containerd/cgroups/v3 v3.0.3
go: downloading github.com/containerd/errdefs v0.1.0
go: downloading github.com/cloudwego/base64x v0.1.4
go: downloading golang.org/x/arch v0.11.0
go: downloading github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
go: downloading github.com/klauspost/cpuid/v2 v2.2.8
go: downloading github.com/bytedance/sonic/loader v0.2.1
go: downloading github.com/twitchyliquid64/golang-asm v0.15.1
go: downloading github.com/cloudwego/iasm v0.2.0
go: github.com/containers/podman-bootc/pkg/vm imports
	golang.org/x/crypto/ssh: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/cmd imports
	github.com/containers/podman/v5/pkg/domain/entities imports
	github.com/containers/common/pkg/ssh imports
	golang.org/x/crypto/ssh/agent: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/cmd imports
	github.com/containers/podman/v5/pkg/domain/entities imports
	github.com/containers/common/pkg/ssh imports
	golang.org/x/crypto/ssh/knownhosts: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/signature imports
	golang.org/x/crypto/openpgp: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/copy imports
	github.com/containers/ocicrypt imports
	golang.org/x/crypto/openpgp/packet: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/copy imports
	github.com/containers/image/v5/signature/sigstore imports
	github.com/secure-systems-lab/go-securesystemslib/encrypted imports
	golang.org/x/crypto/nacl/secretbox: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/copy imports
	github.com/containers/image/v5/signature/sigstore imports
	github.com/secure-systems-lab/go-securesystemslib/encrypted imports
	golang.org/x/crypto/scrypt: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/copy imports
	github.com/containers/image/v5/signature/sigstore imports
	github.com/sigstore/sigstore/pkg/signature imports
	golang.org/x/crypto/sha3: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/copy imports
	github.com/containers/ocicrypt imports
	github.com/containers/ocicrypt/keywrap/jwe imports
	github.com/go-jose/go-jose/v3 imports
	golang.org/x/crypto/pbkdf2: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/signature imports
	github.com/sigstore/sigstore/pkg/cryptoutils imports
	github.com/letsencrypt/boulder/goodkey imports
	github.com/letsencrypt/boulder/core imports
	golang.org/x/crypto/ocsp: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer
go: github.com/containers/podman-bootc/pkg/utils imports
	github.com/containers/podman/v5/pkg/machine imports
	github.com/containers/podman/v5/pkg/machine/ocipull imports
	github.com/containers/image/v5/signature imports
	github.com/sigstore/sigstore/pkg/cryptoutils imports
	github.com/letsencrypt/boulder/goodkey imports
	github.com/letsencrypt/boulder/core imports
	gopkg.in/go-jose/go-jose.v2 imports
	golang.org/x/crypto/ed25519: golang.org/x/[email protected]: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.35.0.zip": stream error: stream ID 31; INTERNAL_ERROR; received from peer

bootc-bot bot force-pushed the bootc-renovate/go-golang.org-x-crypto-vulnerability branch 2 times, most recently from 9f98355 to 248195f Compare September 9, 2025 13:19

bootc-bot bot force-pushed the bootc-renovate/go-golang.org-x-crypto-vulnerability branch from 248195f to c6f0773 Compare September 24, 2025 16:12

bootc-bot bot force-pushed the bootc-renovate/go-golang.org-x-crypto-vulnerability branch 2 times, most recently from 6200fa5 to 1e18793 Compare October 13, 2025 22:09

bootc-bot bot force-pushed the bootc-renovate/go-golang.org-x-crypto-vulnerability branch from 1e18793 to 8fb1390 Compare October 24, 2025 18:13

bootc-bot bot force-pushed the bootc-renovate/go-golang.org-x-crypto-vulnerability branch from 8fb1390 to c3d6a62 Compare November 5, 2025 20:12

Update module golang.org/x/crypto to v0.35.0 [SECURITY]

db101b4

Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>

bootc-bot bot force-pushed the bootc-renovate/go-golang.org-x-crypto-vulnerability branch from c3d6a62 to db101b4 Compare November 10, 2025 16:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update module golang.org/x/crypto to v0.35.0 [SECURITY] #113

Update module golang.org/x/crypto to v0.35.0 [SECURITY] #113

Uh oh!

bootc-bot bot commented Sep 5, 2025 •

edited

Loading

Uh oh!

bootc-bot bot commented Sep 5, 2025

Uh oh!

bootc-bot bot commented Sep 5, 2025

Uh oh!

bootc-bot bot commented Nov 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update module golang.org/x/crypto to v0.35.0 [SECURITY] #113

Are you sure you want to change the base?

Update module golang.org/x/crypto to v0.35.0 [SECURITY] #113

Uh oh!

Conversation

bootc-bot bot commented Sep 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2024-45337

CVE-2025-22869

Configuration

Uh oh!

bootc-bot bot commented Sep 5, 2025

ℹ Artifact update notice

File name: go.mod

Uh oh!

bootc-bot bot commented Sep 5, 2025

Edited/Blocked Notification

Uh oh!

bootc-bot bot commented Nov 10, 2025

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

bootc-bot bot commented Sep 5, 2025 •

edited

Loading