FlawAtlas
Search the atlas
CVE-2022-27191 High

CVE-2022-27191

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

Exploit probability 3.9%
Published March 18, 2022
Required by Not available
Last source change July 24, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown
Go golang.org/x/crypto
Go golang.org/x/crypto

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2022-27191

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

View original source
Open Source Vulnerabilities GHSA-8c26-wmh5-6g9v

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

View original source
Open Source Vulnerabilities GO-2021-0356

Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that 1) the Signer passed to AddHostKey does not implement AlgorithmSigner, and 2) the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey method. Servers that only use Signer implementations provided by the ssh package are unaffected.

View original source

05 / REFERENCES

Further evidence