PT-2022-6957 · Unknown+3 · Golang.Org/X/Crypto/Ssh+3
Rod Hynes
·
Published
2022-01-10
·
Updated
2025-10-11
·
CVE-2021-43565
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
golang.org/x/crypto/ssh package versions prior to 0.0.0-20211202192323-5770296d904e
Description
The issue is related to insufficient input validation in the golang.org/x/crypto/ssh package, which can be exploited by a remote attacker to cause a denial of service. Specifically, when using AES-GCM or ChaCha20Poly1305, consuming a malformed packet with an empty plaintext can cause a panic in the SSH server. An unauthenticated attacker can exploit this to panic the SSH server.
Recommendations
For versions prior to 0.0.0-20211202192323-5770296d904e, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the SSH server or implementing additional validation on incoming packets to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Suse
Golang.Org/X/Crypto/Ssh