Security Advisories

CGA-594w-mv7g-h3x7

Published

Last updated

https://images.chainguard.dev/security/CGA-594w-mv7g-h3x7

Package

k3d

Latest Update

Fixed

Fixed Version

5.6.0-r11

Aliases

CVE-2021-43565
GHSA-gwc9-m7rh-j2ww

Severity

7.5

High

CVSS V3

Summary

x/crypto/ssh vulnerable to panic via malformed packets

Description

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43565
https://github.com/advisories/GHSA-gwc9-m7rh-j2ww
https://go.dev/cl/368814
https://go.dev/issues/49932
https://groups.google.com/forum/#!forum/golang-announce
https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs
https://pkg.go.dev/vuln/GO-2022-0968

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CGA-594w-mv7g-h3x7

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources