GHSA-89gr-r52h-f8rx
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | golang.org/x/crypto | < 0.52.0 | 0.52.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
References
External links from the advisory. They lead to third-party sites.