The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go…
Priority MEDIUM 40CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 fixed, 13 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-327.
Summary
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Why it matters now
EPSS 0.03963 90th percentileScored 2026-11-07
Fix Partial golang.org/x/crypto (Go): 0.0.0-20220314234659-1baeb1ce4c0bRed Hat: 24 advisoriesRed Hat: 12 fixed, 13 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | golang.org/x/crypto (Go) | before 0.0.0-20220314234659-1baeb1ce4c0b | 0.0.0-20220314234659-1baeb1ce4c0b | Patch available | GHSA-8c26-wmh5-6g9v |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- golang.org/x/crypto (Go) Vendor— Affected before 0.0.0-20220314234659-1baeb1ce4c0b Fixed in 0.0.0-20220314234659-1baeb1ce4c0b Patch available GHSA-8c26-wmh5-6g9v
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:* | before 0.0.0-20220314234659-1baeb1ce4c0b | Vulnerable | Go standard library |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
- cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:* Versions before 0.0.0-20220314234659-1baeb1ce4c0b Vulnerable ·Go standard library
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
Remediation
- Fix · GHSA-8c26-wmh5-6g9v golang.org/x/crypto (Go) Fixed in 0.0.0-20220314234659-1baeb1ce4c0b Advisory →
Red Hat 24 advisories
- RHSA-2026:79243 Released 2026-10-08 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
- RHSA-2023:4488 Released 2023-08-07 · Red Hat rating ModerateRed Hat OpenShift support for Windows Containers 6.0.1[security update]
- Red Hat OpenShift Container Platform 4.11 openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2023:3943 Released 2023-06-29 · Red Hat rating ModerateACS 4.1 enhancement and security update
- RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8
Show 21 more Red Hat advisories
- RHSA-2023:3366 Released 2023-06-07 · Red Hat rating ImportantOpenShift Container Platform 4.13.2 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-api-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-common-1:21.3.1-0.20230510075528.b3c902e.el9 +3
- Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.16.1.el9_2, buildah-1:1.29.1-1.1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.1.rhaos4.13.el9 +47
- RHSA-2023:1325 Released 2023-05-18 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-4.el9, python3-werkzeug-2.0.3-4.el9
- Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.rhaos4.13.el9, cri-o-1.26.3-3.rhaos4.13.git641290e.el9 +27
- RHSA-2023:1326 Released 2023-05-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2022:9096 Released 2023-01-30 · Red Hat rating ModerateRed Hat OpenShift support for Windows Containers 7.0.0 [security update]
- Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2022:7401 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-aws-efs-csi-driver-container-rhel8, openshift4/ose-node-feature-discovery
- RHSA-2022:9107 Released 2023-01-04 · Red Hat rating ModerateOpenShift Container Platform 4.11.21 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-baremetal-installer-rhel8, openshift4/ose-installer-artifacts
- RHSA-2022:8893 Released 2022-12-15 · Red Hat rating ModerateOpenShift Container Platform 4.11.20 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-installer
- RHSA-2022:8938 Released 2022-12-13 · Red Hat rating LowRelease of OpenShift Serverless 1.26.0
- Red Hat OpenShift Serverless 1.26 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2022:8932 Released 2022-12-12 · Red Hat rating LowRelease of OpenShift Serverless Client kn 1.26.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.5.0-3.el8
- RHSA-2022:8634 Released 2022-11-28 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.1 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-velero-rhel8
- RHSA-2022:8008 Released 2022-11-15 · Red Hat rating Moderatebuildah security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.27.0-2.el9, buildah-tests-1:1.27.0-2.el9
- RHSA-2022:7954 Released 2022-11-15 · Red Hat rating Moderatepodman security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.2.0-3.el9, podman-docker-2:4.2.0-3.el9, podman-gvproxy-2:4.2.0-3.el9 +3
- RHSA-2022:7469 Released 2022-11-08 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.s390x::container-tools:4.0 +47
- RHSA-2022:7457 Released 2022-11-08 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.aarch64::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.ppc64le::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.s390x::container-tools:rhel8 +47
- RHSA-2022:6527 Released 2022-09-15 · Red Hat rating ModerateOpenShift Virtualization 4.11.0 RPMs security and bug fix update
- CNV 4.11 for RHEL 7 kubevirt-4.11.0-643.el7, kubevirt-virtctl-4.11.0-643.el7, kubevirt-virtctl-redistributable-4.11.0-643.el7
- CNV 4.11 for RHEL 8 kubevirt-4.11.0-643.el8, kubevirt-virtctl-4.11.0-643.el8, kubevirt-virtctl-redistributable-4.11.0-643.el8
- RHSA-2022:6526 Released 2022-09-14 · Red Hat rating ImportantOpenShift Virtualization 4.11.0 Images security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6347 Released 2022-09-06 · Red Hat rating ModerateVolSync 0.5 security fixes and updates
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
- RHSA-2022:5069 Released 2022-08-10 · Red Hat rating ImportantOpenShift Container Platform 4.11.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8, openshift4/ose-alibaba-machine-controllers-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
- RHSA-2022:5068 Released 2022-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.11.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
- Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47
- RHSA-2022:4956 Released 2022-06-09 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
- RHSA-2022:1476 Released 2022-04-21 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.3 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Data Foundation 4 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| 8Base-OADP-1.1 | Fixed | RHSA-2022:8634 |
| CNV 4.11 for RHEL 7 | Fixed | RHSA-2022:6527 |
| CNV 4.11 for RHEL 8 | Fixed | RHSA-2022:6527 |
| RHACS 4.1 for RHEL 8 | Fixed | RHSA-2023:3943 |
| Red Hat Ceph Storage 8.1 | Fixed | RHSA-2026:79243 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7457, RHSA-2022:7469 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:7954, RHSA-2022:8008 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5068, RHSA-2022:5069, RHSA-2022:8893, RHSA-2022:9107, RHSA-2023:4488 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7401, RHSA-2022:9096 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:1325, RHSA-2023:1326, RHSA-2023:3366 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:8932 |
| Red Hat OpenShift Serverless 1.26 | Fixed | RHSA-2022:8938 |
Not affected: 14 products
- 8Base-OADP-1.1
- Ironic content for Red Hat OpenShift Container Platform 4.11
- Ironic content for Red Hat OpenShift Container Platform 4.13
- RHACS 4.1 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 3
- Red Hat Ceph Storage 8.1
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Virtualization 4
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-27191
- 2026-10-03 Alias added: GHSA-8c26-wmh5-6g9v
- 2026-10-09 Fix available: RHSA-2026:79243 · Red Hat
- 2026-10-09 Fix available: Red Hat Ceph Storage 8.1 · Red Hat
References
Advisory 15
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/-cp44ypCT5s
- FEDORA-2022-a4c9009f3e
- FEDORA-2022-d37fb34309
- FEDORA-2022-3a63897745
- FEDORA-2022-5cbd6de569
- FEDORA-2022-c87047f163
- https://security.netapp.com/advisory/ntap-20220429-0002/
- FEDORA-2022-14712f9699
- FEDORA-2022-08ae2dd481
- FEDORA-2022-5e637f6cc6
- FEDORA-2022-fae3ecee19
- FEDORA-2022-ba365d3703
- FEDORA-2022-30c5ed5625
- https://nvd.nist.gov/vuln/detail/CVE-2022-27191
Other 17
- https://security.netapp.com/advisory/ntap-20220429-0002
- https://raw.githubusercontent.com/golang/vulndb/df2d3d326300e2ae768f00351ffa96cc2c56cf54/reports/GO-2021-0356.yaml
- https://pkg.go.dev/vuln/GO-2021-0356
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB
- https://lists.fedoraproject.org/archives/list/[email protected]/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ
- https://go.googlesource.com/crypto/+/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d
- https://go.dev/cl/392355
- https://cs.opensource.google/go/x/crypto
Sources
- CVE-2022-27191 · CVE Program
- CVE-2022-27191 · NVD
- FIRST EPSS
- GHSA-8c26-wmh5-6g9v · GitHub Advisory Database · CC BY 4.0
- CVE-2022-27191 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences