Denial of service via crafted Signer in golang.org/x/crypto/ssh
Overview
Source
ID
GO-2021-0356
Aliases
CVE-2022-27191
GHSA-8c26-wmh5-6g9v
Affected package
Description
Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that 1) the Signer passed to AddHostKey does not implement AlgorithmSigner, and 2) the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey method.
Servers that only use Signer implementations provided by the ssh package are unaffected.
Summary
102.49k
Total packages affected
help_outline
Packages with at least one version that is affected by the advisory or has an affected dependency.
11.82k
Packages with a known fix
help_outline
Packages with versions affected by the advisory that have a greater version that is not affected.
7.65%
Total ecosystem affected
help_outline
The proportion of packages in the ecosystem that are affected by the advisory (fixed or not).
Affected Version: Introduced: 0, Fixed: 0.0.0-20220314234659-1baeb1ce4c0b
Patched/Unaffected
Affected