mirror of
https://github.com/matter-labs/vault-auth-tee.git
synced 2025-07-21 07:43:57 +02:00
6ac992c8a4
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | golang.org/x/crypto | `v0.16.0` -> `v0.17.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2023-48795](https://togithub.com/warp-tech/russh/security/advisories/GHSA-45x7-px36-x8w8) ### Summary Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it. ### Mitigations To mitigate this protocol vulnerability, OpenSSH suggested a so-called "strict kex" which alters the SSH handshake to ensure a Man-in-the-Middle attacker cannot introduce unauthenticated messages as well as convey sequence number manipulation across handshakes. **Warning: To take effect, both the client and server must support this countermeasure.** As a stop-gap measure, peers may also (temporarily) disable the affected algorithms and use unaffected alternatives like AES-GCM instead until patches are available. ### Details The SSH specifications of ChaCha20-Poly1305 (chacha20-poly1305@​openssh.com) and Encrypt-then-MAC (*-etm@openssh.com MACs) are vulnerable against an arbitrary prefix truncation attack (a.k.a. Terrapin attack). This allows for an extension negotiation downgrade by stripping the SSH_MSG_EXT_INFO sent after the first message after SSH_MSG_NEWKEYS, downgrading security, and disabling attack countermeasures in some versions of OpenSSH. When targeting Encrypt-then-MAC, this attack requires the use of a CBC cipher to be practically exploitable due to the internal workings of the cipher mode. Additionally, this novel attack technique can be used to exploit previously unexploitable implementation flaws in a Man-in-the-Middle scenario. The attack works by an attacker injecting an arbitrary number of SSH_MSG_IGNORE messages during the initial key exchange and consequently removing the same number of messages just after the initial key exchange has concluded. This is possible due to missing authentication of the excess SSH_MSG_IGNORE messages and the fact that the implicit sequence numbers used within the SSH protocol are only checked after the initial key exchange. In the case of ChaCha20-Poly1305, the attack is guaranteed to work on every connection as this cipher does not maintain an internal state other than the message's sequence number. In the case of Encrypt-Then-MAC, practical exploitation requires the use of a CBC cipher; while theoretical integrity is broken for all ciphers when using this mode, message processing will fail at the application layer for CTR and stream ciphers. For more details see [https://terrapin-attack.com](https://terrapin-attack.com). ### Impact This attack targets the specification of ChaCha20-Poly1305 (chacha20-poly1305@​openssh.com) and Encrypt-then-MAC (*-etm@openssh.com), which are widely adopted by well-known SSH implementations and can be considered de-facto standard. These algorithms can be practically exploited; however, in the case of Encrypt-Then-MAC, we additionally require the use of a CBC cipher. As a consequence, this attack works against all well-behaving SSH implementations supporting either of those algorithms and can be used to downgrade (but not fully strip) connection security in case SSH extension negotiation (RFC8308) is supported. The attack may also enable attackers to exploit certain implementation flaws in a man-in-the-middle (MitM) scenario. --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/matter-labs/vault-auth-tee). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy45My4xIiwidXBkYXRlZEluVmVyIjoiMzcuMTAzLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
229 lines
12 KiB
Modula-2
229 lines
12 KiB
Modula-2
module github.com/matter-labs/vault-auth-tee
|
|
|
|
go 1.19
|
|
|
|
require (
|
|
github.com/hashicorp/go-hclog v1.6.2
|
|
github.com/hashicorp/go-rootcerts v1.0.2
|
|
github.com/hashicorp/vault v1.14.1
|
|
github.com/hashicorp/vault/api v1.9.2
|
|
github.com/hashicorp/vault/sdk v0.9.2-0.20230704151349-7522ca248f90
|
|
github.com/stretchr/testify v1.8.4
|
|
golang.org/x/crypto v0.17.0
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go/compute v1.19.3 // indirect
|
|
cloud.google.com/go/compute/metadata v0.2.3 // indirect
|
|
cloud.google.com/go/iam v1.0.1 // indirect
|
|
cloud.google.com/go/kms v1.10.2 // indirect
|
|
cloud.google.com/go/monitoring v1.13.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go v67.2.0+incompatible // indirect
|
|
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
|
|
github.com/Azure/go-autorest/autorest v0.11.29 // indirect
|
|
github.com/Azure/go-autorest/autorest/adal v0.9.22 // indirect
|
|
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 // indirect
|
|
github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
|
|
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
|
|
github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
|
|
github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
|
|
github.com/Azure/go-autorest/logger v0.2.1 // indirect
|
|
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
|
|
github.com/BurntSushi/toml v1.2.1 // indirect
|
|
github.com/DataDog/datadog-go v3.2.0+incompatible // indirect
|
|
github.com/Jeffail/gabs v1.1.1 // indirect
|
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
|
github.com/Masterminds/semver v1.5.0 // indirect
|
|
github.com/Masterminds/sprig v2.22.0+incompatible // indirect
|
|
github.com/NYTimes/gziphandler v1.1.1 // indirect
|
|
github.com/ProtonMail/go-crypto v0.0.0-20230626094100-7e9e0395ebec // indirect
|
|
github.com/aliyun/alibaba-cloud-sdk-go v1.62.301 // indirect
|
|
github.com/armon/go-metrics v0.4.1 // indirect
|
|
github.com/armon/go-radix v1.0.0 // indirect
|
|
github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef // indirect
|
|
github.com/aws/aws-sdk-go v1.44.268 // indirect
|
|
github.com/axiomhq/hyperloglog v0.0.0-20220105174342-98591331716a // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bgentry/speakeasy v0.1.0 // indirect
|
|
github.com/boombuler/barcode v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v3 v3.2.2 // indirect
|
|
github.com/cenkalti/backoff/v4 v4.2.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.2.0 // indirect
|
|
github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible // indirect
|
|
github.com/circonus-labs/circonusllhist v0.1.3 // indirect
|
|
github.com/cloudflare/circl v1.3.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba // indirect
|
|
github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc // indirect
|
|
github.com/digitalocean/godo v1.7.5 // indirect
|
|
github.com/dimchansky/utfbom v1.1.1 // indirect
|
|
github.com/duosecurity/duo_api_golang v0.0.0-20190308151101-6c680f768e74 // indirect
|
|
github.com/emicklei/go-restful/v3 v3.10.1 // indirect
|
|
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
|
|
github.com/fatih/color v1.15.0 // indirect
|
|
github.com/go-jose/go-jose/v3 v3.0.0 // indirect
|
|
github.com/go-logr/logr v1.2.3 // indirect
|
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
|
github.com/go-openapi/analysis v0.20.0 // indirect
|
|
github.com/go-openapi/errors v0.20.1 // indirect
|
|
github.com/go-openapi/jsonpointer v0.19.6 // indirect
|
|
github.com/go-openapi/jsonreference v0.20.1 // indirect
|
|
github.com/go-openapi/loads v0.20.2 // indirect
|
|
github.com/go-openapi/runtime v0.19.24 // indirect
|
|
github.com/go-openapi/spec v0.20.3 // indirect
|
|
github.com/go-openapi/strfmt v0.20.0 // indirect
|
|
github.com/go-openapi/swag v0.22.3 // indirect
|
|
github.com/go-openapi/validate v0.20.2 // indirect
|
|
github.com/go-ozzo/ozzo-validation v3.6.0+incompatible // indirect
|
|
github.com/go-sql-driver/mysql v1.6.0 // indirect
|
|
github.com/go-test/deep v1.1.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
|
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
|
github.com/golang/protobuf v1.5.3 // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/google/gnostic v0.5.7-v3refs // indirect
|
|
github.com/google/go-cmp v0.5.9 // indirect
|
|
github.com/google/go-metrics-stackdriver v0.2.0 // indirect
|
|
github.com/google/go-querystring v1.1.0 // indirect
|
|
github.com/google/gofuzz v1.2.0 // indirect
|
|
github.com/google/s2a-go v0.1.4 // indirect
|
|
github.com/google/uuid v1.3.0 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.9.1 // indirect
|
|
github.com/gophercloud/gophercloud v0.1.0 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/eventlogger v0.2.1 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-discover v0.0.0-20210818145131-c573d69da192 // indirect
|
|
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/v2 v2.0.9 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2 v2.0.7-1 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/wrappers/alicloudkms/v2 v2.0.1 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 v2.0.8 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/go-memdb v1.3.3 // indirect
|
|
github.com/hashicorp/go-msgpack v1.1.5 // indirect
|
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
|
github.com/hashicorp/go-plugin v1.4.9 // indirect
|
|
github.com/hashicorp/go-raftchunking v0.6.3-0.20191002164813-7e9e8525653a // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 // indirect
|
|
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
|
|
github.com/hashicorp/go-uuid v1.0.3 // indirect
|
|
github.com/hashicorp/go-version v1.6.0 // indirect
|
|
github.com/hashicorp/golang-lru v0.5.4 // indirect
|
|
github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
|
|
github.com/hashicorp/hcp-sdk-go v0.23.0 // indirect
|
|
github.com/hashicorp/mdns v1.0.4 // indirect
|
|
github.com/hashicorp/raft v1.3.10 // indirect
|
|
github.com/hashicorp/raft-autopilot v0.2.0 // indirect
|
|
github.com/hashicorp/raft-boltdb/v2 v2.0.0-20210421194847-a7e34179d62c // indirect
|
|
github.com/hashicorp/raft-snapshot v1.0.4 // indirect
|
|
github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443 // indirect
|
|
github.com/hashicorp/yamux v0.1.1 // indirect
|
|
github.com/huandu/xstrings v1.4.0 // indirect
|
|
github.com/imdario/mergo v0.3.15 // indirect
|
|
github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
|
|
github.com/jefferai/jsonx v1.0.0 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/joyent/triton-go v1.7.1-0.20200416154420-6801d15b779f // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/kelseyhightower/envconfig v1.4.0 // indirect
|
|
github.com/klauspost/compress v1.16.5 // indirect
|
|
github.com/linode/linodego v0.7.1 // indirect
|
|
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.19 // indirect
|
|
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
|
|
github.com/miekg/dns v1.1.43 // indirect
|
|
github.com/mitchellh/cli v1.1.2 // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 // indirect
|
|
github.com/oklog/run v1.1.0 // indirect
|
|
github.com/okta/okta-sdk-golang/v2 v2.12.1 // indirect
|
|
github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
|
|
github.com/oracle/oci-go-sdk/v60 v60.0.0 // indirect
|
|
github.com/packethost/packngo v0.1.1-0.20180711074735-b9cb5096f54c // indirect
|
|
github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
|
|
github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
|
|
github.com/pierrec/lz4 v2.6.1+incompatible // indirect
|
|
github.com/pires/go-proxyproto v0.6.1 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/posener/complete v1.2.3 // indirect
|
|
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
|
|
github.com/pquerna/otp v1.2.1-0.20191009055518-468c2dd2b58d // indirect
|
|
github.com/prometheus/client_golang v1.14.0 // indirect
|
|
github.com/prometheus/client_model v0.3.0 // indirect
|
|
github.com/prometheus/common v0.37.0 // indirect
|
|
github.com/prometheus/procfs v0.8.0 // indirect
|
|
github.com/rboyer/safeio v0.2.1 // indirect
|
|
github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03 // indirect
|
|
github.com/ryanuber/go-glob v1.0.0 // indirect
|
|
github.com/sasha-s/go-deadlock v0.2.0 // indirect
|
|
github.com/sethvargo/go-limiter v0.7.1 // indirect
|
|
github.com/shirou/gopsutil/v3 v3.22.6 // indirect
|
|
github.com/sirupsen/logrus v1.9.0 // indirect
|
|
github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d // indirect
|
|
github.com/sony/gobreaker v0.4.2-0.20210216022020-dd874f9dd33b // indirect
|
|
github.com/spf13/pflag v1.0.5 // indirect
|
|
github.com/stretchr/objx v0.5.0 // indirect
|
|
github.com/tencentcloud/tencentcloud-sdk-go v1.0.162 // indirect
|
|
github.com/tklauser/go-sysconf v0.3.10 // indirect
|
|
github.com/tklauser/numcpus v0.4.0 // indirect
|
|
github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c // indirect
|
|
github.com/vmware/govmomi v0.18.0 // indirect
|
|
github.com/yusufpapurcu/wmi v1.2.2 // indirect
|
|
go.etcd.io/bbolt v1.3.7 // indirect
|
|
go.mongodb.org/mongo-driver v1.11.6 // indirect
|
|
go.opencensus.io v0.24.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
golang.org/x/net v0.17.0 // indirect
|
|
golang.org/x/oauth2 v0.8.0 // indirect
|
|
golang.org/x/sync v0.2.0 // indirect
|
|
golang.org/x/sys v0.15.0 // indirect
|
|
golang.org/x/term v0.15.0 // indirect
|
|
golang.org/x/text v0.14.0 // indirect
|
|
golang.org/x/time v0.3.0 // indirect
|
|
google.golang.org/api v0.124.0 // indirect
|
|
google.golang.org/appengine v1.6.7 // indirect
|
|
google.golang.org/genproto v0.0.0-20230525154841-bd750badd5c6 // indirect
|
|
google.golang.org/grpc v1.56.3 // indirect
|
|
google.golang.org/protobuf v1.30.0 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
gopkg.in/ini.v1 v1.66.2 // indirect
|
|
gopkg.in/resty.v1 v1.12.0 // indirect
|
|
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
|
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
k8s.io/api v0.27.2 // indirect
|
|
k8s.io/apimachinery v0.27.2 // indirect
|
|
k8s.io/client-go v0.27.2 // indirect
|
|
k8s.io/klog/v2 v2.90.1 // indirect
|
|
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
|
|
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 // indirect
|
|
nhooyr.io/websocket v1.8.7 // indirect
|
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
|
|
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
|
|
sigs.k8s.io/yaml v1.3.0 // indirect
|
|
)
|