golang.org/x/crypto: Potential Server Deadlock Vulnerability
An early warning has been issued regarding a potential vulnerability in golang.org/x/crypto that could allow a malicious SSH peer to cause a server deadlock by sending unsolicited global request responses.
What happened
Reportedly, a malicious SSH peer could exploit this vulnerability by sending unsolicited global request responses, which could fill an internal buffer and block the connection's read loop. This could result in a resource leak per connection, as the blocked goroutine could not be released by calling Close(). To mitigate this risk, unsolicited global responses are now discarded.
The vulnerability is tracked under GHSA-VGWF-H737-FF37 and affects multiple versions of golang.org/x/crypto. The recommended action is to upgrade to the latest version of golang.org/x/crypto to mitigate the risk of server deadlock. The affected versions and their corresponding fixed versions can be found in the provided threat data.
This incident is under investigation, and the primary sources should be consulted for the most up-to-date information. It is important for software engineers to assess their exposure and take appropriate action to protect their systems.
How 0Day mitigates this
golang.org/x/crypto is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.