seclog: please fix vulnerability like CVE-2025-22868, CVE-2025-22869, CVE-2024-45337

[bill-liu-workday]

Summary

We found the following vulnerability even in the latest version 3.21.
CVE-2025-22868 (Go oauth2 package DoS vulnerability):
https://nvd.nist.gov/vuln/detail/CVE-2025-22868​

CVE-2025-22869 (Go crypto/ssh DoS vulnerability in file transfer protocols):
https://nvd.nist.gov/vuln/detail/CVE-2025-22869​

CVE-2024-45337 (Go crypto/ssh authorization bypass vulnerability):
https://nvd.nist.gov/vuln/detail/CVE-2024-45337​

Details

Here are the solutions for the three vulnerabilities:

CVE-2025-22868 (Go oauth2 package DoS vulnerability):

The vulnerability in the golang.org/x/oauth2 package allows a maliciously crafted token to cause denial of service due to excessive memory consumption.

The fix is to upgrade the golang.org/x/oauth2 package to version v0.27.0 or later, which includes a patch to safely handle token parsing.

Apply this upgrade in your project dependencies and rebuild/redeploy any applications using this package to mitigate the DoS risk.

CVE-2025-22869 (Go crypto/ssh DoS vulnerability in file transfer protocols):

This vulnerability affects the crypto/ssh package, specifically SCP and SFTP protocols, causing Denial of Service via crafted requests.

Upgrade your Go environment to version 1.25.2, 1.26.1 or later where this issue is fixed.

Additionally, if using Linux distributions or vendor packages, apply relevant security patches they provide.

Monitoring resource usage during SSH file transfers is recommended as an interim mitigation.

CVE-2024-45337 (Go crypto/ssh authorization bypass vulnerability):

This critical authorization bypass flaw in the crypto/ssh package is fixed in Go versions 1.24.6, 1.25.8, and later.

Upgrade your Go runtime environment or crypto/ssh dependency accordingly.

Verify strict SSH authorization configuration in your applications for additional security.

Apply vendor patches where applicable.

Summary:
For all three issues, the primary solution is upgrading the relevant Go packages or the Go runtime itself to secure patched versions:

golang.org/x/oauth2 to v0.27.0+ for CVE-2025-22868,

Go 1.25.2 / 1.26.1+ for CVE-2025-22869,

Go 1.24.6 / 1.25.8+ for CVE-2024-45337.

Ensure you test and deploy updated versions promptly to protect your applications against DoS and authorization bypass risks related to these Go vulnerabilities.

References: Official NVD records and Go release notes

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

What kind of vulnerability is it? Who is impacted?

Remediation

Propose a remediation suggestion if you have one. Make it clear that this is just a suggestion, as the maintainer might have a better idea to fix the issue.

[UJESH2K]

Hi everyone 👋
I’d like to work on resolving this issue by addressing all three vulnerabilities mentioned.

Here’s what I’ll be fixing:

CVE-2025-22868 → Upgrade golang.org/x/oauth2 to v0.27.0 or later to patch the DoS vulnerability caused by crafted token parsing.

CVE-2025-22869 → Upgrade golang.org/x/crypto (includes crypto/ssh) to v0.35.0 or later to fix the DoS issue affecting SCP/SFTP file transfer protocols.

CVE-2024-45337 → Ensure the Go runtime or crypto/ssh dependency is updated to a patched version (≥ Go 1.25.8 or 1.26.1) to mitigate the authorization-bypass flaw.

I’ll run govulncheck ./... after the upgrades to confirm that these CVEs are fully mitigated and that the project builds and runs correctly.

Once verified, I’ll open a PR with the updated go.mod / go.sum changes and a summary of the test results.

Please assign this issue to me if possible 🙏
Also, if it qualifies, kindly label the PR as hacktoberfest-accepted, since I’m contributing as part of Hacktoberfest 2025.

Thank you!
— Ujesh (@UJESH2K)

[PriteshKiri]

Hey @UJESH2K

Was this issue addressed in any of your PRs? If yes, then can you please link it to this issue?

[UJESH2K]

Hi, here are the PRs that resolved the vulnerabilities mentioned in this issue:

1.Fix oauth2 CVE-2025-22868 → #5233
2.Fix Go runtime/Crypto DoS CVE-2025-22869 → #5236
3.Fix crypto/ssh authorization bypass CVE-2024-45337 → #5244

All three fixes have been merged into master.