data/reports: add report for CVE-2026-56854 Fixes golang/vulndb#6303 Change-Id: I3ee107d623c8ef3a6d8458396cf826db762659c8 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/823244 Reviewed-by: Neal Patel <nealpatel@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Neal Patel <neal@golang.org> Reviewed-by: Ian Alexander <jitsu@google.com>
diff --git a/data/cve/v5/GO-2026-6303.json b/data/cve/v5/GO-2026-6303.json new file mode 100644 index 0000000..bb873b7 --- /dev/null +++ b/data/cve/v5/GO-2026-6303.json
@@ -0,0 +1,73 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.0", + "cveMetadata": { + "cveId": "CVE-2026-56854" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc" + }, + "title": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh", + "descriptions": [ + { + "lang": "en", + "value": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback." + } + ], + "affected": [ + { + "vendor": "golang.org/x/crypto", + "product": "golang.org/x/crypto/ssh", + "collectionURL": "https://pkg.go.dev", + "packageName": "golang.org/x/crypto/ssh", + "versions": [ + { + "version": "0", + "lessThan": "0.55.0", + "status": "affected", + "versionType": "semver" + } + ], + "programRoutines": [ + { + "name": "connection.serverAuthenticate" + }, + { + "name": "NewServerConn" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-863: Incorrect Authorization" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/issue/80213" + }, + { + "url": "https://go.dev/cl/797040" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6303" + } + ], + "credits": [ + { + "lang": "en", + "value": "Longwei Wang (@gn00295120)" + } + ] + } + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6303.json b/data/osv/GO-2026-6303.json new file mode 100644 index 0000000..f50d00c --- /dev/null +++ b/data/osv/GO-2026-6303.json
@@ -0,0 +1,62 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6303", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-56854" + ], + "summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh", + "details": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.", + "affected": [ + { + "package": { + "name": "golang.org/x/crypto", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.55.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "golang.org/x/crypto/ssh", + "symbols": [ + "NewServerConn", + "connection.serverAuthenticate" + ] + } + ] + } + } + ], + "references": [ + { + "type": "REPORT", + "url": "https://go.dev/issue/80213" + }, + { + "type": "FIX", + "url": "https://go.dev/cl/797040" + } + ], + "credits": [ + { + "name": "Longwei Wang (@gn00295120)" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6303", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/reports/GO-2026-6303.yaml b/data/reports/GO-2026-6303.yaml new file mode 100644 index 0000000..b806e72 --- /dev/null +++ b/data/reports/GO-2026-6303.yaml
@@ -0,0 +1,35 @@ +id: GO-2026-6303 +modules: + - module: golang.org/x/crypto + versions: + - fixed: 0.55.0 + vulnerable_at: 0.54.0 + packages: + - package: golang.org/x/crypto/ssh + symbols: + - connection.serverAuthenticate + derived_symbols: + - NewServerConn +summary: Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh +description: | + The source-address critical option in the Permissions returned + by an authentication callback was only enforced for the + PublicKeyCallback and VerifiedPublicKeyCallback paths, extending + the fix for CVE-2026-46595. Permissions returned by the + PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, + and GSSAPIWithMICConfig.AllowLogin callbacks were not validated + against the client's remote address, so a source-address + restriction set by those callbacks was silently ignored. The + check is now applied to the Permissions returned by any + authentication callback. +credits: + - Longwei Wang (@gn00295120) +references: + - report: https://go.dev/issue/80213 + - fix: https://go.dev/cl/797040 +cve_metadata: + id: CVE-2026-56854 + cwe: 'CWE-863: Incorrect Authorization' +source: + id: go-security-team +review_status: REVIEWED