golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic
Published Feb 20, 2020
7.5
HIGHCVSS 3.1
EPSS 20.89%
Description
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Affected products
No data.
Configuration 1
- 0.0.0-20200220183623-bac4c82f6975
Configuration 2
- 9.0
No data.
3scale API Management 2.10 on RHEL 7
3scale-amp2/3scale-rhel7-operator-metadata:2.10.0-38
Fixed · RHSA-2021:1129
3scale API Management 2.10 on RHEL 7
3scale-amp2/3scale-rhel7-operator:1.13.0-17
Fixed · RHSA-2021:1129
3scale API Management 2.10 on RHEL 7
3scale-amp2/apicast-rhel7-operator-metadata:2.10.0-9
Fixed · RHSA-2021:1129
3scale API Management 2.10 on RHEL 7
3scale-amp2/apicast-rhel7-operator:1.13.0-4
Fixed · RHSA-2021:1129
Jaeger-1.17
distributed-tracing/jaeger-agent-rhel7:1.17.6-1
Fixed · RHSA-2020:3370
Jaeger-1.17
distributed-tracing/jaeger-all-in-one-rhel7:1.17.6-1
Fixed · RHSA-2020:3370
Jaeger-1.17
distributed-tracing/jaeger-collector-rhel7:1.17.6-1
Fixed · RHSA-2020:3370
Jaeger-1.17
distributed-tracing/jaeger-es-index-cleaner-rhel7:1.17.6-1
Fixed · RHSA-2020:3370
Jaeger-1.17
distributed-tracing/jaeger-es-rollover-rhel7:1.17.6-1
Fixed · RHSA-2020:3370
Jaeger-1.17
distributed-tracing/jaeger-ingester-rhel7:1.17.6-1
Fixed · RHSA-2020:3370
Jaeger-1.17
distributed-tracing/jaeger-query-rhel7:1.17.6-1
Fixed · RHSA-2020:3370
Jaeger-1.17
distributed-tracing/jaeger-rhel7-operator:1.17.6-1
Fixed · RHSA-2020:3370
OpenShift Service Mesh 1.0
openshift-service-mesh/3scale-istio-adapter-rhel8:1.0.0-8
Fixed · RHSA-2020:3372
OpenShift Service Mesh 1.1
ior-0:1.1.6-1.el8
Fixed · RHSA-2020:3369
OpenShift Service Mesh 1.1
servicemesh-0:1.1.6-1.el8
Fixed · RHSA-2020:3369
OpenShift Service Mesh 1.1
servicemesh-cni-0:1.1.6-1.el8
Fixed · RHSA-2020:3369
OpenShift Service Mesh 1.1
servicemesh-grafana-0:6.4.3-13.el8
Fixed · RHSA-2020:3369
OpenShift Service Mesh 1.1
servicemesh-operator-0:1.1.6-2.el8
Fixed · RHSA-2020:3369
OpenShift Service Mesh 1.1
servicemesh-prometheus-0:2.14.0-14.el8
Fixed · RHSA-2020:3369
Openshift Service Mesh 1.1
kiali-0:v1.12.10.redhat2-1.el7
Fixed · RHSA-2020:3369
Red Hat OpenShift Container Platform 4.3
openshift-clients-0:4.3.31-202007250052.p0.git.3329.59998b9.el7
Fixed · RHBA-2020:3179
Red Hat OpenShift Container Platform 4.3
openshift4/ose-azure-machine-controllers:v4.3.31-202007272153.p0
Fixed · RHBA-2020:3180
Red Hat OpenShift Container Platform 4.3
openshift4/ose-sriov-dp-admission-controller:v4.3.37-202009151447.p0
Fixed · RHSA-2020:3809
Red Hat OpenShift Container Platform 4.4
openshift4/ose-azure-machine-controllers:v4.4.0-202006290400.p0
Fixed · RHSA-2020:2790
Red Hat OpenShift Container Platform 4.4
openshift4/ose-baremetal-rhel7-operator:v4.4.0-202006290400.p0
Fixed · RHSA-2020:2789
Red Hat OpenShift Container Platform 4.4
openshift4/ose-cloud-credential-operator:v4.4.0-202007060343.p0
Fixed · RHSA-2020:2878
Red Hat OpenShift Container Platform 4.4
openshift4/ose-cluster-machine-approver:v4.4.0-202007171809.p0
Fixed · RHSA-2020:3078
Red Hat OpenShift Container Platform 4.4
openshift4/ose-descheduler:v4.4.0-202006290400.p0
Fixed · RHSA-2020:2793
Red Hat OpenShift Container Platform 4.5
openshift-0:4.5.0-202007012112.p0.git.0.582d7fc.el7
Fixed · RHSA-2020:2413
Red Hat OpenShift Container Platform 4.5
openshift4/ose-cluster-kube-descheduler-operator:v4.5.0-202007131801.p0
Fixed · RHSA-2020:3414
Red Hat OpenShift Container Platform 4.5
openshift4/ose-cluster-logging-operator:v4.5.0-202007012112.p0
Fixed · RHSA-2020:2412
Red Hat OpenShift Container Platform 4.5
openshift4/ose-descheduler:v4.5.0-202007101023.p0
Fixed · RHSA-2020:3414
Red Hat OpenShift Container Platform 4.6
openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0
Fixed · RHSA-2020:4298
OpenShift Service Mesh 1
jaeger
Out of support scope
OpenShift Service Mesh 1
jaeger-operator
Out of support scope
Red Hat Enterprise Linux 7
gomtree
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift-cluster-autoscaler
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift-descheduler
Will not fix
Red Hat OpenShift Container Platform 3.11
golang-github-openshift-oauth-proxy
Will not fix
Red Hat OpenShift Container Platform 3.11
openshift-enterprise-cluster-capacity
Will not fix
Red Hat OpenShift Container Platform 4
openshift-enterprise-service-catalog
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-baremetal-installer-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-baremetal-machine-controllers-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-authentication-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-autoscaler-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-bootstrap
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-capacity
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-config-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-network-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-openshift-apiserver-rhel9-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-policy-controller-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-svcat-apiserver-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-svcat-controller-manager-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-console-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-descheduler
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-descheduler-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-installer
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-installer-artifacts
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-kube-proxy
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-libvirt-machine-controllers
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-local-storage-static-provisioner
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-helm-container-rhel8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-oauth-proxy
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-operator-marketplace
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-ptp
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-sdn-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-service-ca-rhel9-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-service-catalog
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-vertical-pod-autoscaler-rhel8
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-vertical-pod-autoscaler-rhel9-operator
Affected
Red Hat OpenShift Container Platform 4
template-service-broker-container
Fix deferred
Red Hat OpenShift Virtualization 1
ember-csi-operator
Out of support scope
Red Hat OpenShift Virtualization 1
kubevirt-cpu-node-labeller
Fix deferred
Red Hat OpenShift Virtualization 1
kubevirt-metrics-collector
Fix deferred
Red Hat OpenShift Virtualization 1
kubevirt-web-ui
Fix deferred
Red Hat OpenShift Virtualization 1
kubevirt-web-ui-operator
Fix deferred
Red Hat OpenShift Virtualization 1
multus-cni
Fix deferred
Red Hat OpenShift Virtualization 1
ovs-cni-plugin
Fix deferred
Red Hat OpenShift Virtualization 1
sriov-network-device-plugin
Fix deferred
Red Hat OpenShift Virtualization 1
virt-api
Fix deferred
Red Hat OpenShift Virtualization 1
virt-cdi-apiserver
Out of support scope
Red Hat OpenShift Virtualization 1
virt-cdi-cloner
Out of support scope
Red Hat OpenShift Virtualization 1
virt-cdi-controller
Out of support scope
Red Hat OpenShift Virtualization 1
virt-cdi-importer
Out of support scope
Red Hat OpenShift Virtualization 1
virt-cdi-operator
Out of support scope
Red Hat OpenShift Virtualization 1
virt-cdi-uploadproxy
Out of support scope
Red Hat OpenShift Virtualization 1
virt-cdi-uploadserver
Out of support scope
Red Hat OpenShift Virtualization 1
virt-controller
Fix deferred
Red Hat OpenShift Virtualization 1
virt-handler
Fix deferred
Red Hat OpenShift Virtualization 1
virt-launcher
Fix deferred
Red Hat OpenShift Virtualization 1
virt-operator
Fix deferred
Red Hat OpenShift Virtualization 2
kubernetes-nmstate-handler
Not affected
Red Hat OpenShift Virtualization 2
kubevirt-cpu-node-labeller
Affected
Red Hat OpenShift Virtualization 2
kubevirt-metrics-collector
Not affected
Red Hat OpenShift Virtualization 2
node-maintenance-operator
Not affected
Red Hat OpenShift Virtualization 2
virt-api
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-apiserver
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-cloner
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-controller
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-importer
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-operator
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-uploadproxy
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-uploadserver
Affected
Red Hat OpenShift Virtualization 2
virt-controller
Affected
Red Hat OpenShift Virtualization 2
virt-handler
Affected
Red Hat OpenShift Virtualization 2
virt-launcher
Affected
Red Hat OpenShift Virtualization 2
virt-operator
Affected
Red Hat Openshift Container Storage 4
ocs4/cephcsi-rhel8
Fix deferred
Red Hat Openshift Container Storage 4
ocs4/mcg-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/ocs-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/rook-ceph-rhel8-operator
Not affected
Red Hat Storage 3
grafana
Not affected
Red Hat Storage 3
heketi
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| 3scale API Management 2.10 on RHEL 7 | 3scale-amp2/3scale-rhel7-operator-metadata:2.10.0-38 | Fixed | RHSA-2021:1129 |
| 3scale API Management 2.10 on RHEL 7 | 3scale-amp2/3scale-rhel7-operator:1.13.0-17 | Fixed | RHSA-2021:1129 |
| 3scale API Management 2.10 on RHEL 7 | 3scale-amp2/apicast-rhel7-operator-metadata:2.10.0-9 | Fixed | RHSA-2021:1129 |
| 3scale API Management 2.10 on RHEL 7 | 3scale-amp2/apicast-rhel7-operator:1.13.0-4 | Fixed | RHSA-2021:1129 |
| Jaeger-1.17 | distributed-tracing/jaeger-agent-rhel7:1.17.6-1 | Fixed | RHSA-2020:3370 |
| Jaeger-1.17 | distributed-tracing/jaeger-all-in-one-rhel7:1.17.6-1 | Fixed | RHSA-2020:3370 |
| Jaeger-1.17 | distributed-tracing/jaeger-collector-rhel7:1.17.6-1 | Fixed | RHSA-2020:3370 |
| Jaeger-1.17 | distributed-tracing/jaeger-es-index-cleaner-rhel7:1.17.6-1 | Fixed | RHSA-2020:3370 |
| Jaeger-1.17 | distributed-tracing/jaeger-es-rollover-rhel7:1.17.6-1 | Fixed | RHSA-2020:3370 |
| Jaeger-1.17 | distributed-tracing/jaeger-ingester-rhel7:1.17.6-1 | Fixed | RHSA-2020:3370 |
| Jaeger-1.17 | distributed-tracing/jaeger-query-rhel7:1.17.6-1 | Fixed | RHSA-2020:3370 |
| Jaeger-1.17 | distributed-tracing/jaeger-rhel7-operator:1.17.6-1 | Fixed | RHSA-2020:3370 |
| OpenShift Service Mesh 1.0 | openshift-service-mesh/3scale-istio-adapter-rhel8:1.0.0-8 | Fixed | RHSA-2020:3372 |
| OpenShift Service Mesh 1.1 | ior-0:1.1.6-1.el8 | Fixed | RHSA-2020:3369 |
| OpenShift Service Mesh 1.1 | servicemesh-0:1.1.6-1.el8 | Fixed | RHSA-2020:3369 |
| OpenShift Service Mesh 1.1 | servicemesh-cni-0:1.1.6-1.el8 | Fixed | RHSA-2020:3369 |
| OpenShift Service Mesh 1.1 | servicemesh-grafana-0:6.4.3-13.el8 | Fixed | RHSA-2020:3369 |
| OpenShift Service Mesh 1.1 | servicemesh-operator-0:1.1.6-2.el8 | Fixed | RHSA-2020:3369 |
| OpenShift Service Mesh 1.1 | servicemesh-prometheus-0:2.14.0-14.el8 | Fixed | RHSA-2020:3369 |
| Openshift Service Mesh 1.1 | kiali-0:v1.12.10.redhat2-1.el7 | Fixed | RHSA-2020:3369 |
| Red Hat OpenShift Container Platform 4.3 | openshift-clients-0:4.3.31-202007250052.p0.git.3329.59998b9.el7 | Fixed | RHBA-2020:3179 |
| Red Hat OpenShift Container Platform 4.3 | openshift4/ose-azure-machine-controllers:v4.3.31-202007272153.p0 | Fixed | RHBA-2020:3180 |
| Red Hat OpenShift Container Platform 4.3 | openshift4/ose-sriov-dp-admission-controller:v4.3.37-202009151447.p0 | Fixed | RHSA-2020:3809 |
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-azure-machine-controllers:v4.4.0-202006290400.p0 | Fixed | RHSA-2020:2790 |
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-baremetal-rhel7-operator:v4.4.0-202006290400.p0 | Fixed | RHSA-2020:2789 |
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-cloud-credential-operator:v4.4.0-202007060343.p0 | Fixed | RHSA-2020:2878 |
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-cluster-machine-approver:v4.4.0-202007171809.p0 | Fixed | RHSA-2020:3078 |
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-descheduler:v4.4.0-202006290400.p0 | Fixed | RHSA-2020:2793 |
| Red Hat OpenShift Container Platform 4.5 | openshift-0:4.5.0-202007012112.p0.git.0.582d7fc.el7 | Fixed | RHSA-2020:2413 |
| Red Hat OpenShift Container Platform 4.5 | openshift4/ose-cluster-kube-descheduler-operator:v4.5.0-202007131801.p0 | Fixed | RHSA-2020:3414 |
| Red Hat OpenShift Container Platform 4.5 | openshift4/ose-cluster-logging-operator:v4.5.0-202007012112.p0 | Fixed | RHSA-2020:2412 |
| Red Hat OpenShift Container Platform 4.5 | openshift4/ose-descheduler:v4.5.0-202007101023.p0 | Fixed | RHSA-2020:3414 |
| Red Hat OpenShift Container Platform 4.6 | openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0 | Fixed | RHSA-2020:4298 |
| OpenShift Service Mesh 1 | jaeger | Out of support scope | n/a |
| OpenShift Service Mesh 1 | jaeger-operator | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | gomtree | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-cluster-autoscaler | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-descheduler | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | golang-github-openshift-oauth-proxy | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift-enterprise-cluster-capacity | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-enterprise-service-catalog | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-installer-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-machine-controllers-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-authentication-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-autoscaler-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-bootstrap | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-capacity | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-config-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-network-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-openshift-apiserver-rhel9-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-policy-controller-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-svcat-apiserver-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-svcat-controller-manager-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-descheduler | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-descheduler-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer-artifacts | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-kube-proxy | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-libvirt-machine-controllers | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-local-storage-static-provisioner | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-helm-container-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-oauth-proxy | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-operator-marketplace | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-ptp | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sdn-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-service-ca-rhel9-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-service-catalog | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-vertical-pod-autoscaler-rhel8 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-vertical-pod-autoscaler-rhel9-operator | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | template-service-broker-container | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | ember-csi-operator | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | kubevirt-cpu-node-labeller | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | kubevirt-metrics-collector | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | kubevirt-web-ui | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | kubevirt-web-ui-operator | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | multus-cni | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | ovs-cni-plugin | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | sriov-network-device-plugin | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | virt-api | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | virt-cdi-apiserver | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | virt-cdi-cloner | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | virt-cdi-controller | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | virt-cdi-importer | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | virt-cdi-operator | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | virt-cdi-uploadproxy | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | virt-cdi-uploadserver | Out of support scope | n/a |
| Red Hat OpenShift Virtualization 1 | virt-controller | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | virt-handler | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | virt-launcher | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 1 | virt-operator | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 2 | kubernetes-nmstate-handler | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | kubevirt-cpu-node-labeller | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | kubevirt-metrics-collector | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | node-maintenance-operator | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-api | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-apiserver | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-cloner | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-controller | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-importer | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-operator | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-uploadproxy | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-uploadserver | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-controller | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-handler | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-launcher | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-operator | Affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/cephcsi-rhel8 | Fix deferred | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/mcg-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/rook-ceph-rhel8-operator | Not affected | n/a |
| Red Hat Storage 3 | grafana | Not affected | n/a |
| Red Hat Storage 3 | heketi | Fix deferred | n/a |
golang.org/x/crypto
Go
Introduced 0 Fixed 0.0.0-20200220183623-bac4c82f6975
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | golang.org/x/crypto | 0 | 0.0.0-20200220183623-bac4c82f6975 |
Remediation
Red Hat statement
OpenShift Container Platform uses the vulnerable library in a number of components but strictly as an SSH client. The severity of this vulnerability is reduced for clients as it requires connections to malicious SSH servers, with the maximum impact only a client crash. This vulnerability is rated Low for OpenShift Container Platform.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (36 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 20.89% (0.20891) | 97.49th | v5 (v2026.06.15) |
| Jun 15, 2026 | 20.89% (0.20891) | 97.23th | v5 (v2026.06.15) |
| Dec 5, 2025 | 18.68% (0.18682) | 95.02th | v4 (v2025.03.14) |
| Nov 21, 2025 | 19.90% (0.19900) | 95.23th | v4 (v2025.03.14) |
| Nov 18, 2025 | 21.37% (0.21371) | 95.31th | v4 (v2025.03.14) |
| Sep 2, 2025 | 19.90% (0.19900) | 95.28th | v4 (v2025.03.14) |
| Jul 16, 2025 | 18.68% (0.18682) | 94.96th | v4 (v2025.03.14) |
| Mar 30, 2025 | 9.06% (0.09062) | 91.86th | v4 (v2025.03.14) |
| Mar 29, 2025 | 19.86% (0.19862) | 92.59th | v4 (v2025.03.14) |
| Mar 28, 2025 | 9.06% (0.09062) | 91.86th | v4 (v2025.03.14) |
| Mar 27, 2025 | 19.86% (0.19862) | 94.66th | v4 (v2025.03.14) |
| Mar 20, 2025 | 9.06% (0.09062) | 91.95th | v4 (v2025.03.14) |
| Mar 19, 2025 | 19.86% (0.19862) | 94.76th | v4 (v2025.03.14) |
| Mar 17, 2025 | 9.06% (0.09062) | 92.02th | v4 (v2025.03.14) |
| Feb 13, 2025 | 13.96% (0.13960) | 95.71th | v3 (v2023.03.01) |
| Jan 29, 2025 | 16.09% (0.16089) | 95.98th | v3 (v2023.03.01) |
| Dec 17, 2024 | 13.75% (0.13749) | 95.61th | v3 (v2023.03.01) |
| Dec 10, 2024 | 26.32% (0.26317) | 96.91th | v3 (v2023.03.01) |
| Apr 16, 2024 | 24.39% (0.24388) | 96.54th | v3 (v2023.03.01) |
| Mar 15, 2024 | 28.72% (0.28718) | 96.74th | v3 (v2023.03.01) |
| Jan 27, 2024 | 24.02% (0.24021) | 96.18th | v3 (v2023.03.01) |
| Oct 20, 2023 | 23.41% (0.23407) | 96.01th | v3 (v2023.03.01) |
| Aug 12, 2023 | 24.14% (0.24139) | 96.00th | v3 (v2023.03.01) |
| Jul 10, 2023 | 14.98% (0.14982) | 95.07th | v3 (v2023.03.01) |
| Jun 17, 2023 | 10.95% (0.10947) | 94.29th | v3 (v2023.03.01) |
| Jun 8, 2023 | 9.52% (0.09523) | 93.88th | v3 (v2023.03.01) |
| May 9, 2023 | 7.09% (0.07088) | 92.94th | v3 (v2023.03.01) |
| Apr 23, 2023 | 5.13% (0.05131) | 91.73th | v3 (v2023.03.01) |
| Mar 7, 2023 | 2.63% (0.02635) | 88.69th | v3 (v2023.03.01) |
| Mar 6, 2023 | 18.53% (0.18528) | 96.33th | v2 (v2022.01.01) |
| Apr 1, 2022 | 18.53% (0.18528) | 95.99th | v2 (v2022.01.01) |
| Feb 4, 2022 | 18.53% (0.18528) | 93.59th | v2 (v2022.01.01) |
| Feb 3, 2022 | 5.36% (0.05363) | 79.74th | v1 |
| Jan 6, 2022 | 5.36% (0.05363) | 79.54th | v1 |
| Sep 1, 2021 | 5.36% (0.05363) | 88.35th | v1 |
| Apr 14, 2021 | 5.36% (0.05363) | 0.00th | v1 |
References (18)
- http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html ExploitThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2020-9283 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1804533 Issue Tracking
- https://github.com/advisories/GHSA-ffhg-7mh4-33c4 Advisory
- https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88adab236
- https://go.dev/cl/220357
- https://go.googlesource.com/crypto/+/bac4c82f69751a6dd76e702d54b3ceb88adab236
- https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
- https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY
- https://groups.google.com/g/golang-announce/c/3L45YRc91SY
- https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html mailing-listMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html mailing-listMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html mailing-listMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2020-9283
- https://pkg.go.dev/vuln/GO-2020-0012
- https://www.cve.org/CVERecord?id=CVE-2020-9283
- https://www.exploit-db.com/exploits/48121
Change history (0)
No recorded changes yet.