golang ssh vulnerabilities

Latest golang ssh CVEs

Newest publication first

1. CVE-2021-43565 x/crypto/ssh vulnerable to panic via malformed packets

   Published 2022-09-06

   High·CVSS 7.5 EPSS 1.2%

   The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

2. CVE-2022-27191 golang.org/x/crypto/ssh Denial of service via crafted Signer

   Published 2022-03-18

   High·CVSS 7.5 EPSS 4.0%

   The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

3. CVE-2020-29652 golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability

   Published 2020-12-17

   High·CVSS 7.5 EPSS 3.2%

   A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.