high7.5
CVE-2021-43565
x/crypto/ssh vulnerable to panic via malformed packets
Impact
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | golang.org/x/crypto | < 0.0.0-20211202192323-5770296d904e | 0.0.0-20211202192323-5770296d904e |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Golang | Ssh | before 0.0.0-20211202192323-5770296d904e |
References
- NVD record
- CVE.org record
- GitHub advisory
- https://groups.google.com/forum/#%21forum/golang-announce
- https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs
- https://github.com/advisories/GHSA-gwc9-m7rh-j2ww
- https://nvd.nist.gov/vuln/detail/CVE-2021-43565
- https://groups.google.com/forum/#!forum/golang-announce
- https://go.dev/cl/368814/
- https://go.dev/issues/49932
- https://pkg.go.dev/vuln/GO-2022-0968