Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
complyctl vendors golang.org/x/crypto v0.55.0 as an indirect dependency (via go-securesystemslib in the Sigstore verification stack). However, the only usage of golang.org/x/crypto/ssh in the entire dependency graph is ssh.NewPublicKey() and ssh.FingerprintSHA256() for DSSE key fingerprinting (go-securesystemslib/dsse/verify.go). The vulnerable symbols (Dial, NewClientConn, NewControlClientConn, NewServerConn) are never called — complyctl does not establish SSH connections. The flaw is therefore not exploitable in complyctl. We will bump golang.org/x/crypto to >= v0.56.0 in a forthcoming dependency update to clear the scanner finding.