)]}'
{
  "commit": "6f39c5226a445a99a6d90f9f29a76feefb1c401f",
  "tree": "0ce7f98d47315e0d9e69a55cacaf1deebec14525",
  "parents": [
    "4c4d20b72c2ffcc65325634d57021774dd2a1750"
  ],
  "author": {
    "name": "Nicola Murino",
    "email": "nicola.murino@gmail.com",
    "time": "Sun May 24 16:25:01 2026 +0200"
  },
  "committer": {
    "name": "Nicola Murino",
    "email": "nicola.murino@gmail.com",
    "time": "Tue Jun 02 00:22:37 2026 -0700"
  },
  "message": "ssh: limit RSA key size in OpenSSH private key parsing\n\nparseOpenSSHPrivateKey builds an rsa.PrivateKey directly from the\nunmarshalled OpenSSH key blob, bypassing parseRSA and its modulus\nlimit. Validate() and Precompute() then perform several modular\nexponentiations whose cost grows with the size of the prime factors;\nin particular Precompute() recomputes the CRT coefficient as\nq^(p-2) mod p, which is cubic in |p|. A maliciously crafted key with\noversized N and P can keep the CPU busy for hours or days during a\nsingle load.\n\nMirror the parseRSA validation here: cap the modulus at 8192 bits\n(the same limit enforced by crypto/tls), reject exponents larger than\n24 bits, and reject invalid exponent values (\u003c 3 or even). In addition,\nbound each prime factor at 4096 bits to prevent the CRT computation\nfrom becoming the dominant cost.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Ia5991f25dd41a22eddd7cf63a8fc5106de9e9663\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782420\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3482c4d2c462f08fa504d5df8e1fd07551f1aefd",
      "old_mode": 33188,
      "old_path": "ssh/keys.go",
      "new_id": "78f0963b8b264404c0c109bb466496488b8b8479",
      "new_mode": 33188,
      "new_path": "ssh/keys.go"
    },
    {
      "type": "modify",
      "old_id": "93a0a135df0ed24a59fa0e95ca22ab4854ec480c",
      "old_mode": 33188,
      "old_path": "ssh/keys_test.go",
      "new_id": "c973c8c09ce712c376fd8d7a801d27086fdc6ae6",
      "new_mode": 33188,
      "new_path": "ssh/keys_test.go"
    }
  ]
}