[Bug 1234583] VUL-0: CVE-2024-45337: chezmoi: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

https://bugzilla.suse.com/show_bug.cgi?id=1234583 https://bugzilla.suse.com/show_bug.cgi?id=1234583#c6 Andrea Mattiazzo <andrea.mattiazzo@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |INVALID --- Comment #6 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- I don't see any call to PublicKeyCallback inside chezmoi sources, so it is not affected and the vendored library doesn't require a bump. Closing the bug as INVALID. -- You are receiving this mail because: You are on the CC list for the bug.