CVE-2021-43565 x/crypto/ssh vulnerable to panic via malformed packets

High 7.5 Published 6 Sep 2022 Updated 4 Aug 2024

An attacker can cause a panic in SSH servers using the golang.org/x/crypto/ssh package, leading to a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-43565?

CVE-2021-43565 is a high-severity denial of service vulnerability in n/a, published on 6 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

Which versions are affected by CVE-2021-43565?

3 open source packages ship an affected version, including golang.org/x/crypto. It affects 1 product.

Package	Affected	Fixed in
`golang.org/x/crypto` Go	All versions	`0.0.0-20211202192323-5770296d904e`
`golang.org/x/crypto` Go	All versions	`0.0.0-20211202192323-5770296d904e`
`golang.org/x/crypto` Go	All versions	`0.0.0-20211202192323-5770296d904e`

Linux distribution packages (17)

`kubevirt` SUSE:Enterprise Storage 7	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Linux Enterprise Module for Containers 15 SP3	All versions	`0.45.0-8.7.1`
`kubevirt` SUSE:Linux Enterprise Module for Containers 15 SP3	All versions	`0.49.0-150300.8.10.1`
`kubevirt` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Manager Proxy 4.1	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Manager Retail Branch Server 4.1	All versions	`0.40.0-5.17.2`
`kubevirt` SUSE:Manager Server 4.1	All versions	`0.40.0-5.17.2`
`kafka` SUSE:Package Hub 15 SP2	All versions	`2.1.0-bp152.2.3.1`
`kafka-kit` SUSE:Package Hub 15 SP2	All versions	`2.1.0-bp152.2.3.1`
`kubevirt` openSUSE:Leap 15.3	All versions	`0.45.0-8.7.1`
`kubevirt` openSUSE:Leap 15.3	All versions	`0.49.0-150300.8.10.1`
`docker` openSUSE:Tumbleweed	All versions	`20.10.14_ce-2.1`
`kubevirt` openSUSE:Tumbleweed	All versions	`0.49.0-1.1`

Products include Golang Ssh.

How do I fix CVE-2021-43565?

Upgrade golang.org/x/crypto to 0.0.0-20211202192323-5770296d904e or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-43565 being exploited?

There is no known exploitation of CVE-2021-43565 in the wild and no public exploit code.

CVE-2020-29652 golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability High 7.5

Sources

Also known as AZL-43338, AZL-43341, AZL-43344, AZL-43347, AZL-43348, CLEANSTART-2026-EA18639 and 13 more.