ASA-202002-11

ASA-202002-11

Arch Linux Security Advisory ASA-202002-11
==========================================

Severity: High
Date    : 2020-02-20
CVE-ID  : CVE-2020-9283
Package : golang-golang-x-crypto
Type    : denial of service
Remote  : Yes
Link    :

Summary
=======

The package golang-golang-x-crypto before v0.0.20200303-1 for
Go allows a panic during signature verification in the golang.org/x/crypto/ssh
package.

Resolution
==========

Upgrade to 0.0.20200303-1.

# pacman -Syu "golang-golang-x-crypto>=0.0.20200303-1"

The problem has been fixed upstream in version 0.0.20200303-1.

Workaround
==========

None.

Description
===========

An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public key,
such that the library will panic when trying to verify a signature with it.
Clients can deliver such a public key and signature to any
golang.org/x/crypto/ssh server with a PublicKeyCallback, and servers can deliver
them to any golang.org/x/crypto/ssh client.

Impact
======

A remote attacker can make the library panic when trying to perform signature
verification with it by crafting an ssh-ed25519 or sk-ssh-ed25519@openssh.com
public key.

References
==========

https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88adab236

Packages that need to be updated
==========

https://www.archlinux.org/packages/community/any/golang-golang-x-net/
https://www.archlinux.org/packages/community/any/golang-deepin-lib/
https://www.archlinux.org/packages/community/any/golang-golang-x-tools/
https://www.archlinux.org/packages/community/x86_64/dns-over-https/
https://www.archlinux.org/packages/community/x86_64/startdde/
https://www.archlinux.org/packages/community/x86_64/v2ray/