x/crypto: imports vulnerable x/net

[rjboer]

What version of Go are you using (go version)?

$ go version 1.20

Does this issue reproduce with the latest release?

YES

What operating system and processor architecture are you using (go env)?

x64 windows

What did you do?

vulnarebility scanners show error: CVE-2023-44487, CVE-2023-3978 based on a realy old x/net library being referenced in the x/crypto go.mod file. Complete bullshit ofcourse, since the crypto lib itself is not vulnarable to those weaknesses.
It however hinders automatic scanning of opensource projects and obscures real cybersecurity threats (false positive).

golang.org/x/crypto@v0.14.0 › golang.org/x/net@v0.10.0
Fixed in golang.org/x/net@0.17.0

Please update the go.mod file of package x/crypto to x/net to version > 0.17

[mauri870]

Will be addressed by CL 538056

[bcmills]

@golang/release, should there be a step in the security release process to update the // tagx:ignore dependencies in subrepos?

[gcstang]

this still seems to be an issue is there any timeline to fix?
Applications using golang.org/x/crypto are being flagged as security issue due to crypto using an old version of golang.org/x/net:v0.10.0

CVE-2023-44487
CVE-2023-3978

[panagiotis-bitharis]

Nessus scan flags it as security issue
CVE-2023-45288