Recommended action

Update golang.org/x/crypto to 0.52.0; golang.org/x/crypto/ssh/knownhosts to 0.52.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @revoked status affects golang.org/x/crypto (go), golang.org/x/crypto/ssh/knownhosts (go). Severity is critical. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

AI coding agents often install or upgrade packages automatically in go. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update golang.org/x/crypto to 0.52.0; golang.org/x/crypto/ssh/knownhosts to 0.52.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @revoked status affects golang.org/x/crypto (go), golang.org/x/crypto/ssh/knownhosts (go). Severity is critical. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

AI coding agents often install or upgrade packages automatically in go. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software