CVE-2020-29652: Null Pointer Dereference
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
Other sources
A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an option for GSSAPIWithMICConfig, it is possible for an attacker to craft an ssh client connection using the gssapi-with-mic authentication method and cause the server to panic resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-29652?
CVE-2020-29652 is a null pointer dereference vulnerability in the golang.org/x/crypto/ssh component.
How does CVE-2020-29652 impact golang.org/x/crypto?
CVE-2020-29652 can allow an attacker to craft an ssh client connection using the `gssapi-with-mic` authentication method and cause the server to panic.
Which software versions are affected by CVE-2020-29652?
Versions up to 0.0.0-20201216223049 of the golang.org/x/crypto package are affected.
What is the severity of CVE-2020-29652?
The severity of CVE-2020-29652 is high, with a score of 7.5.
How can I fix CVE-2020-29652?
To fix CVE-2020-29652, update the golang.org/x/crypto package to version 0.0.0-20201216223049 or later.