GO-2020-0012

vendorUSosv

Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh

view advisory published 2021-04-14Licence: per source

An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public key, such that the library will panic when trying to verify a signature with it. If verifying signatures using user supplied public keys, this may be used as a denial of service vector.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-9283US	high7.5	20.9% (98th)	Exploit	2020-02-20
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/220357FIX
https://go.googlesource.com/crypto/+/bac4c82f69751a6dd76e702d54b3ceb88adab236FIX
https://groups.google.com/g/golang-announce/c/3L45YRc91SYWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan