)]}'
{
  "commit": "e557b08ec2b4f5dd00f38356919fc7b051dd88f8",
  "tree": "9f9139f33e45b9ece10c070085807f5d3e56051e",
  "parents": [
    "4044611da8b85cbd5eb55c657d59244ffb18d3e4"
  ],
  "author": {
    "name": "Nicola Murino",
    "email": "nicola.murino@gmail.com",
    "time": "Sun Jul 05 18:50:56 2026 +0200"
  },
  "committer": {
    "name": "Nicola Murino",
    "email": "nicola.murino@gmail.com",
    "time": "Sun Jul 12 08:19:37 2026 -0700"
  },
  "message": "ssh: enforce the source-address critical option for all auth callbacks\n\nCVE-2026-46595 extended source-address validation, historically applied\nonly to the Permissions returned by PublicKeyCallback, to the ones\nreturned by VerifiedPublicKeyCallback. The documented contract of\nPermissions.CriticalOptions does not restrict enforcement to a specific\nauthentication method, so move the check to a single point at the end of\neach authentication attempt, where it covers the Permissions returned by\nany callback (password, keyboard-interactive, none and GSSAPI included).\n\nThe check at public key cache insertion time is kept: it remains\nauthoritative for the Permissions returned by PublicKeyCallback, which\nVerifiedPublicKeyCallback may replace before the check at the end of the\nauthentication attempt runs and which are not re-checked on partial\nsuccess. It also still makes public key queries fail before the client\nproduces a signature when PublicKeyCallback supplies the restriction.\n\nFixes CVE-2026-56854\nFixes golang/go#80213\n\nChange-Id: Ibd612a8e4240bd710e33754f3ceb95bb29169d9a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797040\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3c0fcc953eaa79d1f8d0cb1a7cd730c8ec6c05b1",
      "old_mode": 33188,
      "old_path": "ssh/server.go",
      "new_id": "e0e88906f5eea2140d1203583374944b2301f053",
      "new_mode": 33188,
      "new_path": "ssh/server.go"
    },
    {
      "type": "modify",
      "old_id": "01e262b775ff0fc6363ba798b6159197e7d6c945",
      "old_mode": 33188,
      "old_path": "ssh/server_test.go",
      "new_id": "c44cdcffdb76f183cbf8e4c141d246b21d8c3e32",
      "new_mode": 33188,
      "new_path": "ssh/server_test.go"
    }
  ]
}