GO-2020-0012
Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh
At a glance
- Published
- Updated
- CVE
- CVE-2020-9283
- Aliases
- GHSA-ffhg-7mh4-33c4
Description
An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public key, such that the library will panic when trying to verify a signature with it. If verifying signatures using user supplied public keys, this may be used as a denial of service vector.
Affected packages
| Package | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.0.0-20200220183623-bac4c82f6975 |
References
- https://go.dev/cl/220357 FIX
- https://go.googlesource.com/crypto/+/bac4c82f69751a6dd76e702d54b3ceb88adab236 FIX
- https://groups.google.com/g/golang-announce/c/3L45YRc91SY WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |