Nicola Murino
b25012b37b
In serverAuthenticate, the permissions variable is reset to nil at the beginning of the authentication loop. If an authentication callback returns a PartialSuccessError along with non-nil Permissions, those permissions are currently silently discarded before the next authentication step. This change returns an error if a callback returns both a PartialSuccessError and non-nil Permissions, preventing API misuse where the user might erroneously expect those permissions to be preserved or merged into the final session permissions. This issue was found during a security audit by NCC Group Cryptography Services, sponsored by Teleport. Fixes golang/go#79562 Fixes CVE-2026-39828 Change-Id: I632c9e46e2b5e8804ef88081063a3612a2462f9f Reviewed-on: https://go-review.googlesource.com/c/crypto/+/781621 Reviewed-by: Neal Patel <nealpatel@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
Go Cryptography
This repository holds supplementary Go cryptography packages.
Report Issues / Send Patches
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/crypto.
The main issue tracker for the crypto repository is located at https://go.dev/issues. Prefix your issue with "x/crypto:" in the subject line, so it is easy to find.
Note that contributions to the cryptography package receive additional scrutiny due to their sensitive nature. Patches may take longer than normal to receive feedback.