CVE-2020-9283
Improper Verification of Cryptographic Signature in golang.org/x/crypto
Summary
Improper Verification of Cryptographic Signature in golang.org/x/crypto
Original description
The description as published by the source.
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
golang.org/x/crypto
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20200220183623-bac4c82f6975"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2020-9283 golang-go.crypto Fixed in: 1:0.0~git20200221.2aa609c-1
- Ubuntu UBUNTU-CVE-2020-9283 golang-go.crypto
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web go.dev
- web go.googlesource.com
- web groups.google.com
- web groups.google.com
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web pkg.go.dev
- web exploit-db.com
- web packetstormsecurity.com