CVE-2021-43565

golang.org/x/crypto: empty plaintext packet causes panic

Published Sep 6, 2022 CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Description
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-6832 The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
Github GHSA Github GHSA GHSA-gwc9-m7rh-j2ww x/crypto/ssh vulnerable to panic via malformed packets
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8