This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-9283 →

DEBIAN-CVE-2020-9283

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh packa...

Original description

The description as published by the source.

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 golang-go.crypto

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1"}]}]

Debian:13 golang-go.crypto

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1"}]}]

Debian:14 golang-go.crypto

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1"}]}]

References

advisory security-tracker.debian.org