CVE-2020-9283 Improper Verification of Cryptographic Signature in golang.org/x/crypto
A remote attacker can cause a panic in SSH signature verification, leading to a denial of service against SSH servers or clients using the affected Go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9283?
CVE-2020-9283 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 20 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Weakness: CWE-347
Which versions are affected by CVE-2020-9283?
3 open source packages ship an affected version, including golang.org/x/crypto. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/crypto Go | All versions | 0.0.0-20200220183623-bac4c82f6975 |
golang.org/x/crypto Go | All versions | 0.0.0-20200220183623-bac4c82f6975 |
golang.org/x/crypto Go | All versions | 0.0.0-20200220183623-bac4c82f6975 |
Linux distribution packages (4)
openshift-clients Red Hat:openshift:4.3::el7 | All versions | 0:4.3.31-202007250052.p0.git.3329.59998b9.el7 |
openshift-clients-redistributable Red Hat:openshift:4.3::el7 | All versions | 0:4.3.31-202007250052.p0.git.3329.59998b9.el7 |
openshift-clients Red Hat:openshift:4.3::el8 | All versions | 0:4.3.31-202007250052.p0.git.3329.59998b9.el8 |
openshift-clients-redistributable Red Hat:openshift:4.3::el8 | All versions | 0:4.3.31-202007250052.p0.git.3329.59998b9.el8 |
Products include Debian Debian Linux, Golang Package Ssh.
How do I fix CVE-2020-9283?
Upgrade golang.org/x/crypto to 0.0.0-20200220183623-bac4c82f6975 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-9283 being exploited?
There is no known exploitation of CVE-2020-9283 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-9283, DLA-2453-1, DLA-2455-1, GHSA-ffhg-7mh4-33c4, GO-2020-0012, RHBA-2020:3179 and 1 more.