golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Package_ssh | Golang | 0.0.0-20200220183623-bac4c82f6975 (including) | 0.0.0-20200220183623-bac4c82f6975 (including) |
| 3scale API Management 2.10 on RHEL 7 | RedHat | 3scale-amp2/3scale-rhel7-operator:1.13.0-17 | * |
| 3scale API Management 2.10 on RHEL 7 | RedHat | 3scale-amp2/3scale-rhel7-operator-metadata:2.10.0-38 | * |
| 3scale API Management 2.10 on RHEL 7 | RedHat | 3scale-amp2/apicast-rhel7-operator:1.13.0-4 | * |
| 3scale API Management 2.10 on RHEL 7 | RedHat | 3scale-amp2/apicast-rhel7-operator-metadata:2.10.0-9 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-agent-rhel7:1.17.6-1 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-all-in-one-rhel7:1.17.6-1 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-collector-rhel7:1.17.6-1 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-es-index-cleaner-rhel7:1.17.6-1 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-es-rollover-rhel7:1.17.6-1 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-ingester-rhel7:1.17.6-1 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-query-rhel7:1.17.6-1 | * |
| Jaeger-1.17 | RedHat | distributed-tracing/jaeger-rhel7-operator:1.17.6-1 | * |
| OpenShift Service Mesh 1.0 | RedHat | openshift-service-mesh/3scale-istio-adapter-rhel8:1.0.0-8 | * |
| Openshift Service Mesh 1.1 | RedHat | kiali-0:v1.12.10.redhat2-1.el7 | * |
| OpenShift Service Mesh 1.1 | RedHat | ior-0:1.1.6-1.el8 | * |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-0:1.1.6-1.el8 | * |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-cni-0:1.1.6-1.el8 | * |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-grafana-0:6.4.3-13.el8 | * |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-operator-0:1.1.6-2.el8 | * |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-prometheus-0:2.14.0-14.el8 | * |
| Red Hat OpenShift Container Platform 4.3 | RedHat | openshift-clients-0:4.3.31-202007250052.p0.git.3329.59998b9.el7 | * |
| Red Hat OpenShift Container Platform 4.3 | RedHat | openshift4/ose-azure-machine-controllers:v4.3.31-202007272153.p0 | * |
| Red Hat OpenShift Container Platform 4.3 | RedHat | openshift4/ose-sriov-dp-admission-controller:v4.3.37-202009151447.p0 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-baremetal-rhel7-operator:v4.4.0-202006290400.p0 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-azure-machine-controllers:v4.4.0-202006290400.p0 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-descheduler:v4.4.0-202006290400.p0 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cloud-credential-operator:v4.4.0-202007060343.p0 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-machine-approver:v4.4.0-202007171809.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-aws-machine-controllers:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-azure-machine-controllers:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-baremetal-machine-controllers:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cli:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cli-artifacts:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cloud-credential-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-authentication-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-autoscaler:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-autoscaler-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-bootstrap:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-config-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-dns-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-image-registry-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-ingress-operator:v4.5.0-202007070153.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-kube-apiserver-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-kube-controller-manager-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-kube-scheduler-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-monitoring-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-network-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-node-tuning-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-openshift-apiserver-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-openshift-controller-manager-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-samples-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-storage-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-svcat-apiserver-operator:v4.5.0-202007071249.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-update-keys:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-version-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-configmap-reloader:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-console-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-coredns:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-csi-snapshot-controller:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-csi-snapshot-controller-rhel7:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-deployer:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-docker-builder:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-docker-registry:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-etcd:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-grafana:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-haproxy-router:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-installer:v4.5.0-202007071429.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-installer-artifacts:v4.5.0-202007071429.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-ironic-hardware-inventory-recorder-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-ironic-inspector-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-ironic-ipa-downloader-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-ironic-machine-os-downloader-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-ironic-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-ironic-static-ip-manager-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-jenkins:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-jenkins-agent-maven:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-k8s-prometheus-adapter:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-keepalived-ipfailover:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-kube-proxy:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-kube-rbac-proxy:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-kube-state-metrics:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-kuryr-cni-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-kuryr-controller-rhel8:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-libvirt-machine-controllers:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-local-storage-static-provisioner:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-machine-api-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-machine-config-operator:v4.5.0-202007062045.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-multus-admission-controller:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-must-gather:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-oauth-proxy:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-openstack-machine-controllers:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-operator-lifecycle-manager:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-operator-marketplace:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-operator-registry:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-ovn-kubernetes:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-pod:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-prometheus:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-prometheus-alertmanager:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-prometheus-config-reloader:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-prometheus-node-exporter:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-prometheus-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-prom-label-proxy:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-service-ca-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-telemeter:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-tests:v4.5.0-202007100518.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-logging-operator:v4.5.0-202007012112.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift-0:4.5.0-202007012112.p0.git.0.582d7fc.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-cluster-kube-descheduler-operator:v4.5.0-202007131801.p0 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift4/ose-descheduler:v4.5.0-202007101023.p0 | * |
| Red Hat OpenShift Container Platform 4.6 | RedHat | openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0 | * |
| Golang-go.crypto | Ubuntu | bionic | * |
| Golang-go.crypto | Ubuntu | eoan | * |
| Golang-go.crypto | Ubuntu | esm-apps/bionic | * |
| Golang-go.crypto | Ubuntu | esm-infra-legacy/xenial | * |
| Golang-go.crypto | Ubuntu | esm-infra/xenial | * |
| Golang-go.crypto | Ubuntu | xenial | * |
| Mongo-tools | Ubuntu | bionic | * |
| Mongo-tools | Ubuntu | eoan | * |
| Mongo-tools | Ubuntu | focal | * |
| Snapd | Ubuntu | trusty | * |
Related Attack Patterns
References
- http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
- https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY
- https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
- http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
- https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY
- https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html