{"schema_version":"1.7.3","id":"GO-2021-0227","published":"2022-02-17T17:35:32Z","modified":"2026-02-04T03:17:50.287206Z","aliases":["CVE-2020-29652","GHSA-3vm4-22fp-5rfm"],"related":["CGA-hp7g-jcw7-c892"],"summary":"Panic on crafted authentication request message in golang.org/x/crypto/ssh","details":"Clients can cause a panic in SSH servers. An attacker can craft an authentication request message for the “gssapi-with-mic” method which will cause NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil.","affected":[{"package":{"name":"golang.org/x/crypto","ecosystem":"Go","purl":"pkg:golang/golang.org/x/crypto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20201216223049-8b5274cf687f"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/crypto/ssh","symbols":["NewServerConn","connection.serverAuthenticate"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2021-0227.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/278852"},{"type":"FIX","url":"https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2021-0227"},"credits":[{"name":"Joern Schneewesiz (GitLab Security Research Team)"}]}