-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Closed
Description
PR's #1501 / #1500 added support for TLS config using encryption as specified in RFC 1423, however, that functionality has been deprecated in Go, and causes linting to fail on Go 1.16;
cli/context/docker/load.go:69:6: SA1019: x509.IsEncryptedPEMBlock is deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext. (staticcheck)
if x509.IsEncryptedPEMBlock(pemBlock) {
^
cli/context/docker/load.go:70:20: SA1019: x509.DecryptPEMBlock is deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext. (staticcheck)
keyBytes, err = x509.DecryptPEMBlock(pemBlock, []byte(c.TLSPassword))
^
From https://go-review.googlesource.com/c/go/+/264159
It's unfortunate that we don't implement PKCS#8 encryption so we can't
recommend an alternative but PEM encryption is so broken that it's worth
deprecating outright.
We should consider deprecating this functionality (log a warning and/or produce an error)