CVE-2022-27191: High severity IBM Data Virtualization on Cloud Pak for Data vulnerability
A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentication with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability.
Other sources
A potential crash in a golang.org/x/crypto/ssh server under these conditions:
• The server has been configured by passing a Signer to ServerConfig.AddHostKey. • The Signer passed to AddHostKey does not also implement AlgorithmSigner. • The Signer passed to AddHostKey does return a key of type “ssh-rsa” from its PublicKey method.
— Red Hat
Go ssh package is vulnerable to a denial of service, caused by an unspecified flaw in certain circumstances involving AddHostKey. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:8634
- RHSA-2022:8932
- RHSA-2022:4956
- RHSA-2022:6347
- RHSA-2022:7457
- RHSA-2022:7469
- RHSA-2022:7954
- RHSA-2022:8008
- RHSA-2022:5068
- RHSA-2022:5069
- RHSA-2022:8893
- RHSA-2022:9107
- RHSA-2023:4488
- RHSA-2022:7401
- RHSA-2022:9096
- RHSA-2023:1326
- RHSA-2023:3366
- RHSA-2023:3943
- RHSA-2022:6527
- RHSA-2022:6526
- RHSA-2022:8938
- IBM-7183851
Frequently Asked Questions
What is CVE-2022-27191?
CVE-2022-27191 is a vulnerability in the golang.org/x/crypto/ssh package that allows an attacker to crash a server by failing authentication with RSA keys.
What is the severity of CVE-2022-27191?
CVE-2022-27191 has a severity level of high.
How does CVE-2022-27191 affect golang.org/x/crypto/ssh?
CVE-2022-27191 causes a client to fail authentication with RSA keys to servers that reject SHA-2 signature algorithms.
How can I fix CVE-2022-27191?
To fix CVE-2022-27191, upgrade to golang.org/x/crypto/ssh version 0.0.0-20220314234659-1baeb1ce4c0b or later.
Are there any references for CVE-2022-27191?
Yes, you can find references for CVE-2022-27191 at the following links: [link1], [link2], [link3].