Nicola Murino
ffd87b4878
Previously, if CertChecker.IsHostAuthority or CertChecker.IsUserAuthority were left unset, calling CheckHostKey or Authenticate would result in a nil pointer dereference panic. This change adds checks to ensure these callbacks are defined before invocation, returning an error instead of panicking. This issue was found during a security audit by NCC Group Cryptography Services, sponsored by Teleport. Fixes golang/go#79563 Fixes CVE-2026-39835 Change-Id: I2bd9c8d76646232e49f6aedc7b5334f3825918be Reviewed-on: https://go-review.googlesource.com/c/crypto/+/781660 Commit-Queue: Neal Patel <nealpatel@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Neal Patel <nealpatel@google.com>
Go Cryptography
This repository holds supplementary Go cryptography packages.
Report Issues / Send Patches
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/crypto.
The main issue tracker for the crypto repository is located at https://go.dev/issues. Prefix your issue with "x/crypto:" in the subject line, so it is easy to find.
Note that contributions to the cryptography package receive additional scrutiny due to their sensitive nature. Patches may take longer than normal to receive feedback.