CVE-2024-45337

[nicon89]

There's a CVE-2024-45337 detected in the mgob binary.

mgob (gobinary)
===============
Total: 1 (HIGH: 0, CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬────────┬────────────────────────────────────┬───────────────┬────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │         Installed Version          │ Fixed Version │                         Title                          │
├─────────────────────┼────────────────┼──────────┼────────┼────────────────────────────────────┼───────────────┼────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2024-45337 │ CRITICAL │ fixed  │ v0.0.0-20220622213112-05595931fe9d │ 0.31.0        │ golang.org/x/crypto/ssh: Misuse of                     │
│                     │                │          │        │                                    │               │ ServerConfig.PublicKeyCallback may cause authorization │
│                     │                │          │        │                                    │               │ bypass in golang.org/x/crypto                          │
│                     │                │          │        │                                    │               │ https://avd.aquasec.com/nvd/cve-2024-45337             │
└─────────────────────┴────────────────┴──────────┴────────┴────────────────────────────────────┴───────────────┴────────────────────────────────────────────────────────┘

@maxisam can you check it out?

[maxisam]

Thanks! feel free to make a PR

[nicon89]

@maxisam sure, there you go: #155

[nicon89]

Btw, is there any reason why you keep 3 require sections in go.mod?

[maxisam]

I'm actually not an expert of go, so welcome to refactor it if you think it's not needed.

I will try to get to that PR this week.

Thanks for helping 😊