CVE-2022-27191: Golang.org/x/crypto Denial of Service Vulnerability

Q: What is CVE-2022-27191?

CVE-2022-27191 is a security vulnerability in Golang.org/x/crypto involving golang.org/x/crypto/ssh Denial of service via crafted Signer under CWE-327: Use of a Broken or Risky Cryptographic Algorithm.

Q: Which Golang.org/x/crypto versions are affected?

Affected versions include releases prior to 0.0.0-20220314234659-1baeb1ce4c0b across affected packages: golang.org/x/crypto.

Q: What version fixes CVE-2022-27191?

Upgrading to 0.0.0-20220314234659-1baeb1ce4c0b (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is golang.org/x/crypto affected?

Yes, golang.org/x/crypto is affected in releases prior to 0.0.0-20220314234659-1baeb1ce4c0b. Upgrade your dependency to 0.0.0-20220314234659-1baeb1ce4c0b or later.

Q: What is the CVSS score of CVE-2022-27191?

CVE-2022-27191 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Q: What CWE is associated with CVE-2022-27191?

CVE-2022-27191 is classified under CWE-327: Use of a Broken or Risky Cryptographic Algorithm (The product uses a broken or risky cryptographic algorithm or protocol.).

Q: How can I check Go dependencies for CVE-2022-27191?

Run the dependency tree command: 'inspect dependencies for golang.org/x/crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-8c26-wmh5-6g9v

CVSS 7.5

CWE-327

Published 2022-03-19

Advisory Summary

CVE-2022-27191 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-327: Use of a Broken or Risky Cryptographic Algorithm) affecting Golang.org/x/crypto libraries in the Go ecosystem. The issue involves golang.org/x/crypto/ssh denial of service via crafted signer. Remediation is available by upgrading affected packages to version 0.0.0-20220314234659-1baeb1ce4c0b.

CVE-2022-27191 at a Glance

CVE Identifier CVE-2022-27191

GHSA Identifier GHSA-8c26-wmh5-6g9v

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Affected Product Golang.org/x/crypto

Package Ecosystem Go

Published Date 2022-03-19

Last Updated 2023-08-30

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2022-27191

To remediate this vulnerability, upgrade all affected Golang.org/x/crypto dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

golang.org/x/crypto fixed: 0.0.0-20220314234659-1baeb1ce4c0b

Upgrade golang.org/x/crypto to 0.0.0-20220314234659-1baeb1ce4c0b

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for golang.org/x/crypto

How to Check if You Are Affected

To determine whether your application is affected by CVE-2022-27191, inspect your project dependencies for Golang.org/x/crypto:

inspect dependencies for golang.org/x/crypto

Analyze the terminal output to locate any version of Golang.org/x/crypto in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20220314234659-1baeb1ce4c0b), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-327: Use of a Broken or Risky Cryptographic Algorithm, where the product uses a broken or risky cryptographic algorithm or protocol. In Golang.org/x/crypto, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

CVE-2022-27191 Affected Golang.org/x/crypto Versions

1 component(s)

Fixed Versions:

0.0.0-20220314234659-1baeb1ce4c0b

Product / Package	Ecosystem	Affected Versions	Fixed Version
golang.org/x/crypto golang/golang.org/x/crypto	Go	< 0.0.0-20220314234659-1baeb1ce4c0b	0.0.0-20220314234659-1baeb1ce4c0b

References

NVD — CVE-2022-27191 NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-27191

Golang.org/x/crypto Security Information SECURITY

https://security.netapp.com/advisory/ntap-20220429-0002

raw.githubusercontent.com/golang/vulndb/df2d3... WEB

https://raw.githubusercontent.com/golang/vulndb/df2d3d326300e2ae768f00351ffa96cc2c56cf54/reports/GO-2021-0356.yaml

pkg.go.dev/vuln/go-2021-0356 WEB

https://pkg.go.dev/vuln/GO-2021-0356

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ

groups.google.com/g/golang-announce/c... WEB

https://groups.google.com/g/golang-announce/c/-cp44ypCT5s

groups.google.com/g/golang-announce WEB

https://groups.google.com/g/golang-announce

go.googlesource.com/crypto/+/1baeb1ce4c... WEB

https://go.googlesource.com/crypto/+/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d

go.dev/cl/392355 WEB

https://go.dev/cl/392355

cs.opensource.google/go/x/crypto PACKAGE

https://cs.opensource.google/go/x/crypto

Frequently Asked Questions

What is CVE-2022-27191?

CVE-2022-27191 is a security vulnerability in Golang.org/x/crypto involving golang.org/x/crypto/ssh Denial of service via crafted Signer under CWE-327: Use of a Broken or Risky Cryptographic Algorithm.

Which Golang.org/x/crypto versions are affected?

Affected versions include releases prior to 0.0.0-20220314234659-1baeb1ce4c0b across affected packages: golang.org/x/crypto.

What version fixes CVE-2022-27191?

Upgrading to 0.0.0-20220314234659-1baeb1ce4c0b (or the latest patched release for your respective branch) resolves the vulnerability.

Is golang.org/x/crypto affected?

Yes, golang.org/x/crypto is affected in releases prior to 0.0.0-20220314234659-1baeb1ce4c0b. Upgrade your dependency to 0.0.0-20220314234659-1baeb1ce4c0b or later.

What is the CVSS score of CVE-2022-27191?

CVE-2022-27191 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

What CWE is associated with CVE-2022-27191?

CVE-2022-27191 is classified under CWE-327: Use of a Broken or Risky Cryptographic Algorithm (The product uses a broken or risky cryptographic algorithm or protocol.).

How can I check Go dependencies for CVE-2022-27191?

Run the dependency tree command: 'inspect dependencies for golang.org/x/crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8c26-wmh5-6g9v",
  "modified" : "2023-08-30T13:52:18Z",
  "published" : "2022-03-19T00:01:02Z",
  "aliases" : [ "CVE-2022-27191" ],
  "summary" : "golang.org/x/crypto/ssh Denial of service via crafted Signer",
  "details" : "The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "golang.org/x/crypto"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20220314234659-1baeb1ce4c0b"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-27191"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20220429-0002"
  }, {
    "type" : "WEB",
    "url" : "https://raw.githubusercontent.com/golang/vulndb/df2d3d326300e2ae768f00351ffa96cc2c56cf54/reports/GO-2021-0356.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2021-0356"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/golang-announce/c/-cp44ypCT5s"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/golang-announce"
  }, {
    "type" : "WEB",
    "url" : "https://go.googlesource.com/crypto/+/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/cl/392355"
  }, {
    "type" : "PACKAGE",
    "url" : "https://cs.opensource.google/go/x/crypto"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-327" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-03-30T18:48:41Z",
    "nvd_published_at" : "2022-03-18T07:15:00Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Advisory Metadata

Source ID: GHSA-8c26-wmh5-6g9v
Schema Version: 1.4.0
Published: 2022-03-19 00:01
Last Modified: 2023-08-30 13:52
Database Record File: advisories/github-reviewed/2022/03/GHSA-8c26-wmh5-6g9v/GHSA-8c26-wmh5-6g9v.json