{"id":"CVE-2020-9283","aliases":["DEBIAN-CVE-2020-9283","DLA-2402-1","DLA-2453-1","DLA-2455-1","DLA-3455-1","EUVD-2021-1059","GHSA-ffhg-7mh4-33c4","GO-2020-0012","RHBA-2020:3179","RHSA-2020:2413","RHSA-2020:3369","UBUNTU-CVE-2020-9283"],"status":"published","title":"Improper Verification of Cryptographic Signature in golang.org/x/crypto","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.21052,"percentile":0.97592,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-347"],"published":"2020-02-20T00:00:00Z","modified":"2026-10-26T12:02:08Z","exploits":[{"source":"exploitdb","id":"EDB-48121","title":"Go SSH servers 0.0.2 - Denial of Service (PoC)","type":"dos","platform":"linux","date":"2020-02-24","url":"https://www.exploit-db.com/exploits/48121"},{"source":"pocgithub","id":"brompwnie/CVE-2020-9283","title":"brompwnie/CVE-2020-9283","date":"2020-06-02","url":"https://github.com/brompwnie/CVE-2020-9283"}],"fixes":[{"ecosystem":"Go","package":"golang.org/x/crypto","fixed_in":["0.0.0-20200220183623-bac4c82f6975"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"golang-go.crypto","fixed_in":["1:0.0~git20200221.2aa609c-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-go.crypto","fixed_in":["1:0.0~git20200221.2aa609c-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-go.crypto","fixed_in":["1:0.0~git20200221.2aa609c-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"restic","fixed_in":["0.3.3-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"packer","fixed_in":["0.10.2+dfsg-6+deb9u1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients","fixed_in":["0:4.3.31-202007250052.p0.git.3329.59998b9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients-redistributable","fixed_in":["0:4.3.31-202007250052.p0.git.3329.59998b9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients","fixed_in":["0:4.3.31-202007250052.p0.git.3329.59998b9.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients-redistributable","fixed_in":["0:4.3.31-202007250052.p0.git.3329.59998b9.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20200220183623-bac4c82f6975"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1"}]}],"versions":["1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"restic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.3-1+deb9u1"}]}],"versions":["0.3.3-1"]},{"source":"osv","ecosystem":"Debian:9","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2+dfsg-6+deb9u1"}]}],"versions":["0.10.2+dfsg-6"]},{"source":"osv","ecosystem":"Debian:10","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20181203.505ab14-1+deb10u1"}]}],"versions":["1:0.0~git20181203.505ab14-1"],"bundled":3},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20200220183623-bac4c82f6975"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20200220183623-bac4c82f6975"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.31-202007250052.p0.git.3329.59998b9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.31-202007250052.p0.git.3329.59998b9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.31-202007250052.p0.git.3329.59998b9.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.31-202007250052.p0.git.3329.59998b9.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"machine-config-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.2527.d12c3da.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el7","package":"kiali","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.12.10.redhat2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"ior","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-citadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-galley","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-13.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-13.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-discovery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.0-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-sidecar-injector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20150608-1","1:0.0~git20151201.0.7b85b09-2","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20170629.0.5ef0053-1ubuntu1","1:0.0~git20170629.0.5ef0053-1ubuntu2","1:0.0~git20170629.0.5ef0053-2","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mongo-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.11-1","3.2.11-1ubuntu1","3.4.14-1","3.4.14-2","3.6.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mongo-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.3-0ubuntu1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"golang","product":"package_ssh"}],"references":[{"url":"https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY","tags":["x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9283","tags":["advisory"]},{"url":"https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88adab236","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY","tags":["web","article","report"]},{"url":"https://www.exploit-db.com/exploits/48121","tags":["web"]},{"url":"https://go.dev/cl/220357","tags":["web","fix"]},{"url":"https://go.googlesource.com/crypto/+/bac4c82f69751a6dd76e702d54b3ceb88adab236","tags":["web","fix"]},{"url":"https://groups.google.com/g/golang-announce/c/3L45YRc91SY","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2020-0012","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ffhg-7mh4-33c4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-9283","tags":["advisory"]},{"url":"https://github.com/golang/crypto","tags":["package"]},{"url":"https://access.redhat.com/errata/RHBA-2020:3179","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1854927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_3179.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9283","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2413","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843358","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2413.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1860158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11254","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8558","tags":["advisory"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8945","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3369","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1853652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857412","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3369.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","tags":["advisory"]},{"url":"https://hackerone.com/reports/712065","tags":["article"]},{"url":"https://www.npmjs.com/advisories/1523","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11023","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12666","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12666","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12666","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14040","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/39491","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2020-9283","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-9283","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2020-02-20T00:00:00Z","modified":"2024-08-04T10:26:15.873Z","updated_at":"2026-11-02T14:35:49.538427Z"}],"euvd":[{"id":"EUVD-2021-1059","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2020-02-20T00:00:00Z","modified":"2024-08-04T10:26:15Z","updated_at":"2026-11-03T03:07:54.599277Z"}],"ghsa":[{"id":"GHSA-ffhg-7mh4-33c4","title":"Improper Verification of Cryptographic Signature in golang.org/x/crypto","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2021-05-18T15:29:31Z","modified":"2023-02-16T00:14:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2020-9283","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2020-02-20T20:15:10.437Z","modified":"2026-06-17T03:27:42.05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:05:54.796125Z"}],"osv":[{"id":"CVE-2020-9283","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2020-02-20T20:15:10.437Z","modified":"2026-03-14T14:48:27.291068Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-9283","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2020-02-20T20:15:10.437Z","modified":"2026-10-26T12:02:08.082627438Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-ffhg-7mh4-33c4","title":"Improper Verification of Cryptographic Signature in golang.org/x/crypto","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2021-05-18T15:29:31Z","modified":"2026-09-10T03:49:14.643258279Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"RHBA-2020:3179","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.31 packages update","status":"published","published":"2024-09-30T13:54:32Z","modified":"2026-10-19T10:01:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2020:2413","title":"Red Hat Security Advisory: OpenShift Container Platform 4.5 package security update","status":"published","published":"2024-09-30T13:54:06Z","modified":"2026-10-19T10:01:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3369","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update","status":"published","published":"2024-09-30T13:53:57Z","modified":"2026-10-19T10:01:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2020-9283","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.","status":"published","published":"2020-02-20T20:15:00Z","modified":"2026-07-09T12:47:02.896651583Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DLA-2402-1","title":"golang-go.crypto - security update","status":"published","published":"2020-10-08T00:00:00Z","modified":"2026-03-09T01:23:02.294731Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2453-1","title":"restic - security update","status":"published","published":"2020-11-17T00:00:00Z","modified":"2026-03-09T01:19:37.05249Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2455-1","title":"packer - security update","status":"published","published":"2020-11-19T00:00:00Z","modified":"2026-03-09T01:20:05.318889Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3455-1","title":"golang-go.crypto - security update","status":"published","published":"2023-06-16T00:00:00Z","modified":"2026-03-09T01:23:30.808978Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"GO-2020-0012","title":"Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh","description":"An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public key, such that the library will panic when trying to verify a signature with it. If verifying signatures using user supplied public keys, this may be used as a denial of service vector.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-02-04T03:36:34.30612Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}