golang.org/x/crypto Vulnerability: Potential Server Deadlock

Severity

HIGH

Affected component

golang.org/x/crypto (go)

Affected versions

< 0.0.0-20201216223049-8b5274cf687f or < 0.52.0 or >= 0.1.0, < 0.17.0 or < 0.0.0-20231218163308-9d2ee975ef9f or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.52.0 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.52.0 or < 0.45.0 or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20211202192323-5770296d904e or < 0.35.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190320223903-b7391e95e576 or < 0.52.0 or < 0.31.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.52.0 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20201216223049-8b5274cf687f or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.0.0-20190320223903-b7391e95e576 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.0.0-20211202192323-5770296d904e or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.17.0 or < 0.0.0-20220525230936-793ad666bf5e or < 0.31.0 or < 0.35.0 or < 0.43.0 or < 0.45.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0

Patched version

Not yet available

An early warning has been issued for a potential vulnerability in golang.org/x/crypto that could cause a server deadlock due to unexpected responses. Users of affected versions should take immediate action.

What happened

An early warning has been issued regarding a potential vulnerability in the golang.org/x/crypto package. This vulnerability, tracked as GHSA-VGWF-H737-FF37, could allow a malicious SSH peer to send unsolicited global request responses, potentially leading to a server deadlock. The issue arises when an internal buffer is filled, blocking the connection's read loop and causing a resource leak per connection. This vulnerability is under investigation and has not been exploited in the wild.

The affected versions of golang.org/x/crypto include those less than 0.0.0-20201216223049-8b5274cf687f, 0.52.0, 0.1.0, 0.17.0, 0.0.0-20231218163308-9d2ee975ef9f, 0.0.0-20220314234659-1baeb1ce4c0b, 0.0.0-20200124225646-8b5121be2f68, 0.0.0-20200220183623-bac4c82f6975, 0.0.0-20211202192323-5770296d904e, 0.35.0, 0.45.0, 0.0.0-20190320223903-b7391e95e576, 0.31.0, 0.0.0-20190424203555-c05e17bb3b2d, 0.0.0-20170330155735-e4e2799dd7aa, 0.0.0-20200220183623-bac4c82f6975, 0.0.0-20170330155735-e4e2799dd7aa, 0.0.0-20201216223049-8b5274cf687f, 0.0.0-20220314234659-1baeb1ce4c0b, 0.0.0-20190320223903-b7391e95e576, 0.0.0-20200124225646-8b5121be2f68, 0.0.0-20211202192323-5770296d904e, 0.0.0-20190424203555-c05e17bb3b2d, 0.17.0, 0.0.0-20220525230936-793ad666bf5e, 0.31.0, 0.35.0, 0.43.0, 0.45.0, and 0.52.0. Users of these versions should assess their exposure and take appropriate action.

What to do about it

• Monitor SSH connections for any unusual behavior.
• Consider applying updates as they become available.
• No official fix has been published yet. Monitor the sources below for updates.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [GHSA-vgwf-h737-ff37] golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

Join the 0Day waitlist →

← Back to all threats