Your submission was sent successfully! Close

CVE-2020-9283

Published: 20 February 2020

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

Notes

AuthorNote
jdstrand
snapd contains an embedded copy of golang-go.crypto
lxd in 18.04 LTS and earlier contains an embedded copy of
golang-go.crypto
mdeslaur
snapd and lxd only use the terminal sub-package, not the ssh
part of golang-go.crypto, so they are not vulnerable
Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
golang-go.crypto
Launchpad, Ubuntu, Debian
bionic Needed

eoan Ignored
(reached end-of-life)
focal Not vulnerable
(1:0.0~git20200221.2aa609c-1)
groovy Not vulnerable
(1:0.0~git20200221.2aa609c-1)
hirsute Not vulnerable
(1:0.0~git20200221.2aa609c-1)
impish Not vulnerable
(1:0.0~git20200221.2aa609c-1)
jammy Not vulnerable
(1:0.0~git20200221.2aa609c-1)
kinetic Not vulnerable
(1:0.0~git20200221.2aa609c-1)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Needed

Patches:
upstream: https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88adab236
lxd
Launchpad, Ubuntu, Debian
bionic Not vulnerable

eoan Not vulnerable
(code-not-present)
focal Not vulnerable
(code-not-present)
groovy Not vulnerable
(code-not-present)
hirsute Not vulnerable
(code-not-present)
impish Not vulnerable
(code-not-present)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable

mongo-tools
Launchpad, Ubuntu, Debian
bionic Needs triage

eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

snapd
Launchpad, Ubuntu, Debian
bionic Not vulnerable

eoan Not vulnerable

focal Not vulnerable

groovy Not vulnerable

hirsute Not vulnerable

impish Not vulnerable

jammy Not vulnerable

kinetic Not vulnerable

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable