CVE-2022-27191

Name of the Vulnerable Software and Affected Versions golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go golang.org/x/crypto/ssh versions through 1.16.15 golang.org/x/crypto/ssh versions 1.17.x through 1.17.8

Description The issue is related to the use of defective cryptographic algorithms in the golang.org/x/crypto/ssh package, which can cause a crash in SSH servers under certain circumstances involving AddHostKey. An attacker can exploit this to crash a server. The vulnerability is triggered when a Signer is passed to ServerConfig.AddHostKey that does not implement AlgorithmSigner and returns a key of type “ssh-rsa” from its PublicKey method.

Recommendations For golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b, update to a version after 0.0.0-20220314234659-1baeb1ce4c0b. For golang.org/x/crypto/ssh versions through 1.16.15, update to a version after 1.16.15. For golang.org/x/crypto/ssh versions 1.17.x through 1.17.8, update to a version after 1.17.8. As a temporary workaround, consider restricting the use of the AddHostKey function with Signers that do not implement AlgorithmSigner until a patch is available.