A vulnerability was found in x-crypto on Go. It has been classified as critical. This affects an unknown part of the component Signature Verification Handler. The manipulation with an unknown input leads to a signature verification vulnerability. CWE is classifying the issue as CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

The weakness was published 02/20/2020 (Website). The advisory is shared at groups.google.com. This vulnerability is uniquely identified as CVE-2020-9283 since 02/19/2020. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 0.0.0-20200220183623-bac4c82f6975 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (48121). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• x-crypto

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion