CVE-2020-9283
High · 7.5CVSS
7.5
EPSS
20.9%
Published
Feb 20, 2020
CISA due date
—
The record
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | golang.org/x/crypto | 0 | 0.0.0-20200220183623-bac4c82f6975 |
| Chainguard | k3d | 0 | 5.6.0-r11 |
| Chainguard | k3d-proxy | 0 | 5.6.0-r11 |
| Chainguard | k3d-tools | 0 | 5.6.0-r11 |
| Debian:10 | golang-go.crypto | 0 | 1:0.0~git20181203.505ab14-1+deb10u1 |
| Debian:11 | golang-go.crypto | 0 | 1:0.0~git20200221.2aa609c-1 |
| Debian:12 | golang-go.crypto | 0 | 1:0.0~git20200221.2aa609c-1 |
| Debian:13 | golang-go.crypto | 0 | 1:0.0~git20200221.2aa609c-1 |
| Debian:9 | golang-go.crypto | 0 | 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1 |
| Debian:9 | packer | 0 | 0.10.2+dfsg-6+deb9u1 |
| Debian:9 | restic | 0 | 0.3.3-1+deb9u1 |
| Red Hat:openshift:4.3::el7 | openshift-clients | 0 | 0:4.3.31-202007250052.p0.git.3329.59998b9.el7 |
| Red Hat:openshift:4.3::el7 | openshift-clients-redistributable | 0 | 0:4.3.31-202007250052.p0.git.3329.59998b9.el7 |
| Red Hat:openshift:4.3::el8 | openshift-clients | 0 | 0:4.3.31-202007250052.p0.git.3329.59998b9.el8 |
| Red Hat:openshift:4.3::el8 | openshift-clients-redistributable | 0 | 0:4.3.31-202007250052.p0.git.3329.59998b9.el8 |
| Red Hat:openshift:4.5::el7 | openshift | 0 | 0:4.5.0-202007012112.p0.git.0.582d7fc.el7 |
| Red Hat:openshift:4.5::el7 | openshift-hyperkube | 0 | 0:4.5.0-202007012112.p0.git.0.582d7fc.el7 |
| Red Hat:openshift:4.5::el8 | machine-config-daemon | 0 | 0:4.5.0-202007012112.p0.git.2527.d12c3da.el8 |
| Red Hat:openshift:4.5::el8 | openshift | 0 | 0:4.5.0-202007012112.p0.git.0.582d7fc.el8 |
| Red Hat:openshift:4.5::el8 | openshift-hyperkube | 0 | 0:4.5.0-202007012112.p0.git.0.582d7fc.el8 |
| Red Hat:service_mesh:1.1::el7 | kiali | 0 | 0:v1.12.10.redhat2-1.el7 |
| Red Hat:service_mesh:1.1::el8 | ior | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-citadel | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-cni | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-galley | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-grafana | 0 | 0:6.4.3-13.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-grafana-prometheus | 0 | 0:6.4.3-13.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-istioctl | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-mixc | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-mixs | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-operator | 0 | 0:1.1.6-2.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-pilot-agent | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-pilot-discovery | 0 | 0:1.1.6-1.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-prometheus | 0 | 0:2.14.0-14.el8 |
| Red Hat:service_mesh:1.1::el8 | servicemesh-sidecar-injector | 0 | 0:1.1.6-1.el8 |
| Ubuntu:18.04:LTS | mongo-tools | 0 | No fix |
| Ubuntu:20.04:LTS | golang-go.crypto | 0 | 1:0.0~git20200221.2aa609c-1 |
| Ubuntu:20.04:LTS | mongo-tools | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | golang-go.crypto | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | golang-go.crypto | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | mongo-tools | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | mongo-tools | 0 | No fix |
| Wolfi | k3d | 0 | 5.6.0-r11 |
| Wolfi | k3d-proxy | 0 | 5.6.0-r11 |
| Wolfi | k3d-tools | 0 | 5.6.0-r11 |
| go | golang.org/x/crypto | 0.0.0-20200220183623-bac4c82f6975 | No fix |
Related vulnerabilities
- CVE-2025-47914 golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of… Also affects golang.org/x/crypto
- CVE-2025-58181 golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption Also affects golang.org/x/crypto
- CVE-2025-47913 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and… Also affects golang.org/x/crypto
- CVE-2024-45337 Applications and libraries which misuse connection.serverAuthenticate (via callback field… Also affects golang.org/x/crypto
- CVE-2023-48795 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… Also affects golang.org/x/crypto
- CVE-2021-43565 The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto… Also affects golang.org/x/crypto
- CVE-2022-27191 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go… Also affects golang.org/x/crypto
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects k3d