CVE-2022-27191: Use of a Broken or Risky Cryptographic Algorithm

March 19, 2022 (updated March 30, 2022)

golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b in Go through 1.16.15 and 1.17.x through 1.17.8 allows an attacker to crash a server in certain circumstances involving AddHostKey.

References

github.com/advisories/GHSA-8c26-wmh5-6g9v
groups.google.com/g/golang-announce
groups.google.com/g/golang-announce/c/-cp44ypCT5s
nvd.nist.gov/vuln/detail/CVE-2022-27191

Code Behaviors & Features

Detect and mitigate CVE-2022-27191 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →