golang.org/x/crypto: Potential Server Deadlock Vulnerability
An early warning has been issued regarding a potential vulnerability in golang.org/x/crypto that could allow a malicious SSH peer to cause a server deadlock by sending unsolicited global request responses.
What happened
Reportedly, a malicious SSH peer could exploit a vulnerability in golang.org/x/crypto by sending unsolicited global request responses. This action appears to fill an internal buffer, blocking the connection's read loop. The blocked goroutine cannot be released by calling Close(), resulting in a resource leak per connection. To mitigate this risk, unsolicited global responses are now discarded. The recommended action is to upgrade to the latest version of golang.org/x/crypto.
The affected versions of golang.org/x/crypto include those introduced from version '0' up to various fixed versions such as '0.0.0-20201216223049-8b5274cf687f', '0.52.0', '0.17.0', and others. The specific versions introduced and fixed are detailed in the threat data. Users of these versions should assess their exposure and consider upgrading to a non-affected version.
This incident is under investigation, and further details may emerge. For the most accurate and up-to-date information, consult the primary sources provided.
How 0Day mitigates this
golang.org/x/crypto is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.