HIGH 7.5
GHSA-q4h4-gmj2-qvw2
golang.org/x/crypto/ssh: Invoking byte arithmetic causes underflow and panic
Details
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / golang.org/x/crypto/ssh
Introduced in:
0 Fixed in: 0.52.0 Fix
go get golang.org/x/crypto/ssh@v0.52.0