golang.org/x/crypto/ssh Denial of service via crafted Signer

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-27191 · ADVISORY
• security.netapp.com/advisory/ntap-20220429-0002 · WEB
• raw.githubusercontent.com/golang/vulndb/df2d3d326300e2ae768f00351ffa96cc2c56cf54/reports/GO-2021-0356.yaml · WEB
• pkg.go.dev/vuln/GO-2021-0356 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5 · WEB

golang.org/x/crypto のその他の脆弱性

• CVE-2026-78662高 7.5Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's …
• CVE-2026-56855高 7.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No…
• CVE-2026-56854高 7.5The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and…
• GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
• CVE-2026-46598中 5.3For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.