Go Constraint Extension Serialization Vulnerability in x/crypto/ssh/agent

A vulnerability exists in the Go programming language's x/crypto/ssh/agent package, prior to version 0.52.0, where constraint extensions were not properly serialized when adding keys to a remote agent. This oversight allowed destination restrictions to be silently removed, enabling unrestricted use of the keys on remote hosts. The issue has been addressed by ensuring that all constraint extensions are serialized and by modifying the NewKeyring() function to reject keys with unsupported constraint extensions.

Impact

The vulnerability allowed for unrestricted use of keys on remote hosts by stripping destination restrictions when forwarding keys from the client to the agent.

Remediation

Users can update to Go version v0.52.0 or later, where this vulnerability has been fixed.