PT-2022-6958 · Google+9 · Golang.Org/X/Crypto/Ssh+9
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go
golang.org/x/crypto/ssh versions through 1.16.15
golang.org/x/crypto/ssh versions 1.17.x through 1.17.8
Description
The issue is related to the use of defective cryptographic algorithms in the golang.org/x/crypto/ssh package, which can cause a crash in SSH servers under certain circumstances involving AddHostKey. An attacker can exploit this to crash a server. The vulnerability is triggered when a Signer is passed to ServerConfig.AddHostKey that does not implement AlgorithmSigner and returns a key of type “ssh-rsa” from its PublicKey method.
Recommendations
For golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b, update to a version after 0.0.0-20220314234659-1baeb1ce4c0b.
For golang.org/x/crypto/ssh versions through 1.16.15, update to a version after 1.16.15.
For golang.org/x/crypto/ssh versions 1.17.x through 1.17.8, update to a version after 1.17.8.
As a temporary workaround, consider restricting the use of the AddHostKey function with Signers that do not implement AlgorithmSigner until a patch is available.
Fix
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Red Hat
Red Os
Rocky Linux
Suse
Golang.Org/X/Crypto/Ssh