GO-2022-0968

Panic on malformed packets in golang.org/x/crypto/ssh

At a glance

Published: 2022-09-13 03:32 UTC
Updated: 2026-02-04 04:04 UTC
CVE: CVE-2021-43565
Aliases: GHSA-gwc9-m7rh-j2ww

Description

Unauthenticated clients can cause a panic in SSH servers. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic.

Affected packages

Package	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.0.0-20211202192323-5770296d904e

References

https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs WEB
https://go.dev/issues/49932 REPORT
https://go.dev/cl/368814/ FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database