Priority from VULN: High
This is a copy of the linked VULN ticket issue. You only need to update this ticket and the VULN ticket will be synced accordingly.

---

Vulnerability Details

The following vulnerabilities were found in the third party component pkg:golang/golang.org/x/crypto@v0.32.0 used in the repo: https://github.com/mongodb/mongo-tools:

You are responsible for fixing it by and ensuring the fix is released, if required, by the relevant Due Date.

• A new release is required if the finding is on a stable branch that customers may be using. Stable branches refer to any branch excluding main or master, for products that do not trigger releases directly from main or master branches.

How do I fix this?
You need to update the package to a version that does not contain the vulnerability. Please review the references section for options. If you are still unable to find a fixed version or need additional assistance, please reach out in the #secure-sdlc-program channel.

References:

• https://go.dev/cl/652135
• https://go.dev/issue/71931

Tool Description: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

🔥 Please see go/vuln-flow for detailed guidance.