PT-2022-6958 · Google+9 · Golang.Org/X/Crypto/Ssh+9
Filippo Valsorda
·
Published
2022-03-15
·
Updated
2026-04-01
·
CVE-2022-27191
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go
golang.org/x/crypto/ssh versions through 1.16.15
golang.org/x/crypto/ssh versions 1.17.x through 1.17.8
Description
The issue is related to the use of defective cryptographic algorithms in the golang.org/x/crypto/ssh package, which can cause a crash in SSH servers under certain circumstances involving AddHostKey. An attacker can exploit this to crash a server. The vulnerability is triggered when a Signer is passed to ServerConfig.AddHostKey that does not implement AlgorithmSigner and returns a key of type “ssh-rsa” from its PublicKey method.
Recommendations
For golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b, update to a version after 0.0.0-20220314234659-1baeb1ce4c0b.
For golang.org/x/crypto/ssh versions through 1.16.15, update to a version after 1.16.15.
For golang.org/x/crypto/ssh versions 1.17.x through 1.17.8, update to a version after 1.17.8.
As a temporary workaround, consider restricting the use of the AddHostKey function with Signers that do not implement AlgorithmSigner until a patch is available.
Fix
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Red Hat
Red Os
Rocky Linux
Suse
Golang.Org/X/Crypto/Ssh