CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2022-27191
High (7.5). EPSS 3.9% chance of exploitation in the next 30 days. Fixed in golang.org/x/crypto 0.0.0-20220314234659-1baeb1ce4c0b.
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Severity
- EPSS
- 3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:extra_packages_for_enterprise_linux
- fedoraproject:fedora
- golang:ssh
- redhat:advanced_cluster_management_for_kubernetes
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8c26-wmh5-6g9v | Go | golang.org/x/crypto | <0.0.0-20220314234659-1baeb1ce4c0b | 0.0.0-20220314234659-1baeb1ce4c0b |
| GO-2021-0356 | Go | golang.org/x/crypto | <0.0.0-20220314234659-1baeb1ce4c0b | 0.0.0-20220314234659-1baeb1ce4c0b |
References
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/-cp44ypCT5s
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/