GO-2021-0356
Denial of service via crafted Signer in golang.org/x/crypto/ssh
At a glance
- Published
- Updated
- CVE
- CVE-2022-27191
- Aliases
- GHSA-8c26-wmh5-6g9v
Description
Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that 1) the Signer passed to AddHostKey does not implement AlgorithmSigner, and 2) the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey method. Servers that only use Signer implementations provided by the ssh package are unaffected.
Affected packages
| Package | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.0.0-20220314234659-1baeb1ce4c0b |
References
- https://go.dev/cl/392355 FIX
- https://go.googlesource.com/crypto/+/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d FIX
- https://groups.google.com/g/golang-announce WEB
- https://groups.google.com/g/golang-announce/c/-cp44ypCT5s WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |