GO-2020-0012

See a problem?

Source

https://pkg.go.dev/vuln/GO-2020-0012

Import Source

https://vuln.go.dev/ID/GO-2020-0012.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2020-0012

Aliases

Published

2021-04-14T20:04:52Z

Modified

2024-05-20T16:03:47Z

Summary

Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh

Details

An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public key, such that the library will panic when trying to verify a signature with it. If verifying signatures using user supplied public keys, this may be used as a denial of service vector.

References

Credits

- Alex Gaynor, Fish in a Barrel

Affected packages

Go / golang.org/x/crypto

Package

Name: golang.org/x/crypto; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/crypto

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20200220183623-bac4c82f6975

Ecosystem specific

{
    "imports": [
        {
            "path": "golang.org/x/crypto/ssh",
            "symbols": [
                "CertChecker.Authenticate",
                "CertChecker.CheckCert",
                "CertChecker.CheckHostKey",
                "Certificate.Verify",
                "Dial",
                "NewClientConn",
                "NewPublicKey",
                "NewServerConn",
                "NewSignerFromKey",
                "NewSignerFromSigner",
                "ParseAuthorizedKey",
                "ParseKnownHosts",
                "ParsePrivateKey",
                "ParsePrivateKeyWithPassphrase",
                "ParsePublicKey",
                "ParseRawPrivateKey",
                "ParseRawPrivateKeyWithPassphrase",
                "ed25519PublicKey.Verify",
                "parseED25519",
                "parseSKEd25519",
                "skEd25519PublicKey.Verify"
            ]
        }
    ]
}