CVE-2021-43565: Input Validation
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
Other sources
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server.
There's an input validation flaw in golang.org/x/crypto's readCipherPacket() function. An unauthenticated attacker who sends an empty plaintext packet to a program linked with golang.org/x/crypto/ssh could cause a panic, potentially leading to denial of service.
Version v0.0.0-20211202192323-5770296d904e of golang.org/x/crypto fixes a vulnerability in the golang.org/x/crypto/ssh package which allowed unauthenticated clients to cause a panic in SSH servers.
Reference: https://github.com/golang/go/issues/49932
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-43565?
CVE-2021-43565 is a vulnerability in the x/crypto/ssh package of golang.org/x/crypto that allows an unauthenticated attacker to panic an SSH server.
What is the severity of CVE-2021-43565?
The severity of CVE-2021-43565 is high with a score of 7.5.
How does CVE-2021-43565 affect golang.org/x/crypto?
CVE-2021-43565 affects golang.org/x/crypto by allowing an unauthenticated attacker to panic an SSH server.
How do I fix CVE-2021-43565?
To fix CVE-2021-43565, update to version 0.0.0-20211202192323-5770296d904e or later of the x/crypto/ssh package from golang.org/x/crypto.
Are there any references for CVE-2021-43565?
Yes, you can find more information about CVE-2021-43565 at the following references: [CVE-2021-43565](https://www.cve.org/CVERecord?id=CVE-2021-43565), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-43565), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2030787), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:1276).