GitHub Advisoryadvisory · Go

GHSA-ffhg-7mh4-33c4 Improper Verification of Cryptographic Signature in golang.org/x/crypto

HIGH Published 2021-05-18 Modified 2023-02-16 Official page ↗
Aliases
CVE-2020-9283
Ecosystem
Go
Packages
golang.org/x/crypto
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-347
Reviewed
2021-05-17

Affected packages

• Go golang.org/x/crypto: < 0.0.0-20200220183623-bac4c82f6975 → fixed in 0.0.0-20200220183623-bac4c82f6975

Description

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

Related

Alias · CVE (1)

  • CVE-2020-9283 golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References