golang.org/x/crypto Vulnerability: Early Warning and Mitigation Steps
- Severity
- HIGH
- Affected component
- golang.org/x/crypto (go)
- Affected versions
- < 0.0.0-20201216223049-8b5274cf687f or < 0.52.0 or >= 0.1.0, < 0.17.0 or < 0.0.0-20231218163308-9d2ee975ef9f or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.52.0 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.52.0 or < 0.45.0 or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20211202192323-5770296d904e or < 0.35.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190320223903-b7391e95e576 or < 0.52.0 or < 0.31.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.52.0 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20201216223049-8b5274cf687f or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.0.0-20190320223903-b7391e95e576 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.0.0-20211202192323-5770296d904e or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.17.0 or < 0.0.0-20220525230936-793ad666bf5e or < 0.31.0 or < 0.35.0 or < 0.43.0 or < 0.45.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.55.0 or < 0.56.0 or < 0.56.0
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in golang.org/x/crypto that could allow a malicious SSH peer to cause a server deadlock.
What happened
An early warning has been issued for a vulnerability in golang.org/x/crypto. This vulnerability, tracked as GHSA-VGWF-H737-FF37, reportedly allows a malicious SSH peer to send unsolicited global request responses, potentially filling an internal buffer and blocking the connection's read loop. This blockage could result in a resource leak per connection, as the blocked goroutine cannot be released by calling Close(). The vulnerability is under investigation and has not been exploited in the wild.
The affected component is golang.org/x/crypto, with various version ranges identified as vulnerable. These include versions less than 0.0.0-20201216223049-8b5274cf687f, 0.52.0, 0.1.0, 0.17.0, 0.0.0-20231218163308-9d2ee975ef9f, 0.0.0-20220314234659-1baeb1ce4c0b, 0.0.0-20200124225646-8b5121be2f68, 0.45.0, 0.0.0-20200220183623-bac4c82f6975, 0.0.0-20211202192323-5770296d904e, 0.35.0, 0.31.0, 0.55.0, and 0.56.0, among others. The primary sources should be consulted for the most accurate and up-to-date information on affected versions.
Unsolicited global responses are now discarded as a mitigation measure. Users are advised to monitor for updates to golang.org/x/crypto and apply patches as they become available.
What to do about it
- Monitor for updates to golang.org/x/crypto.
- Apply patches to golang.org/x/crypto as soon as they are available.
- Ensure that your version of golang.org/x/crypto is not within the affected version ranges listed in the threat data.
- Discard unsolicited global responses as a temporary mitigation measure.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
golang.org/x/crypto is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using golang.org/x/crypto with any of the vulnerable version ranges listed in the threat data.
What should I do right now?
Monitor for updates to golang.org/x/crypto and apply patches as they become available. Ensure your version is not within the affected ranges.
What versions of golang.org/x/crypto are safe to use?
The threat data does not specify safe versions. Monitor the primary sources for updates on patched versions.