golang.org/x/crypto Vulnerability: Monitor for Updates
- Severity
- HIGH
- Affected component
- golang.org/x/crypto (go)
- Affected versions
- < 0.0.0-20201216223049-8b5274cf687f or < 0.52.0 or >= 0.1.0, < 0.17.0 or < 0.0.0-20231218163308-9d2ee975ef9f or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.52.0 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.52.0 or < 0.45.0 or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20211202192323-5770296d904e or < 0.35.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190320223903-b7391e95e576 or < 0.52.0 or < 0.31.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.52.0 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20201216223049-8b5274cf687f or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.0.0-20190320223903-b7391e95e576 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.0.0-20211202192323-5770296d904e or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.17.0 or < 0.0.0-20220525230936-793ad666bf5e or < 0.31.0 or < 0.35.0 or < 0.43.0 or < 0.45.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0
- Patched version
- Not yet available
An early warning has been issued for a potential vulnerability in golang.org/x/crypto that could lead to a server deadlock. Users of affected versions should take precautions.
What happened
An early warning has been issued regarding a potential vulnerability in the golang.org/x/crypto package. This vulnerability, tracked as GHSA-VGWF-H737-FF37, could allow a malicious SSH peer to send unsolicited global request responses, potentially filling an internal buffer and blocking the connection's read loop. This could result in a resource leak per connection as the blocked goroutine cannot be released by calling Close(). The issue is under investigation and has not been exploited in the wild.
The vulnerability affects specific versions of golang.org/x/crypto. Users of these versions are advised to monitor for updates and apply patches as they become available. The recommended action is to stay informed about the status of this vulnerability and take appropriate measures to secure systems that may be at risk.
What to do about it
- Monitor for updates to golang.org/x/crypto.
- Apply patches to golang.org/x/crypto as soon as they are available.
- Review your system's use of golang.org/x/crypto and assess potential exposure.
- Consider alternative libraries or solutions if the vulnerability poses a significant risk.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
golang.org/x/crypto is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using golang.org/x/crypto with versions less than 0.0.0-20201216223049-8b5274cf687f or less than 0.52.0 or greater than or equal to 0.1.0 and less than 0.17.0 or any other affected version listed in the threat data.
What should I do right now?
Monitor for updates to golang.org/x/crypto and apply patches as they become available. Review your system's use of the package and assess potential exposure.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the sources for updates.