Read the docs
TI-2024-39109 Aliases GHSA-7prj-hgx4-2xc3

Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy

Priority LOW 38CWE-1395Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Security bypass
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-285.

Summary

A security issue was identified in the NanoProxy project related to the `golang.org/x/crypto` dependency. The project was using an outdated version of this dependency, which potentially exposed the system to security vulnerabilities that have been addressed in subsequent updates. Impact: The specific vulnerabilities in the outdated version of `golang.org/x/crypto` could include authorization bypasses, data breaches, or other security risks. These vulnerabilities can be exploited by attackers to compromise the integrity, confidentiality, or availability of the system. Resolution: The issue has been fixed in NanoProxy by upgrading the `golang.org/x/crypto` dependency to version 0.31.0. Users are strongly encouraged to update their instances of NanoProxy to include this fix and ensure they are using the latest secure version of all dependencies. Fixed Version: * `golang.org/x/crypto` upgraded to version 0.31.0.

Why it matters now

Fix Fixed github.com/ryanbekhen/nanoproxy (Go): 0.15.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/ryanbekhen/nanoproxy (Go)before 0.15.00.15.0Patch availableGHSA-7prj-hgx4-2xc3
  • github.com/ryanbekhen/nanoproxy (Go) Vendor— Affected before 0.15.0 Fixed in 0.15.0 Patch available GHSA-7prj-hgx4-2xc3

Remediation

  • Fix · GHSA-7prj-hgx4-2xc3 github.com/ryanbekhen/nanoproxy (Go) Fixed in 0.15.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7prj-hgx4-2xc3

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences