Golang In-Memory Keyring Key Constraint Bypass Vulnerability

A vulnerability exists in the in-memory keyring provided by the Golang crypto package's SSH agent. The NewKeyring() function accepted keys with the ConfirmBeforeUse constraint but failed to enforce it, allowing keys to sign without confirmation. This issue has been addressed in version v0.52.0, where NewKeyring() now returns an error for unsupported constraints.

Impact

Exploitation of this vulnerability allows keys to be used for signing operations without the required confirmation, potentially leading to unauthorized actions or decisions based on the unsigned keys.

Remediation

Users can update to version v0.52.0 of the Golang crypto package to address this vulnerability.