logo

Database

Lack of data validation In golang.org/x/crypto/ssh

Description

x/crypto/ssh vulnerable to panic via malformed packets The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2021-435652. NVD-2021-435653. OSV-2021-435654. OSV-DEBIAN-2021-435655. GHSA-gwc9-m7rh-j2ww6. GCVE-2021-435657. SECURITY-TRACKER-CVE-2021-43565

References

1. https://groups.google.com/forum/#!forum/golang-announce2. https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs3. https://go.dev/cl/3688144. https://go.dev/issues/499325. https://pkg.go.dev/vuln/GO-2022-0968

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.