Loading...

XML

Word

Printable

Severity:
Moderate
Story Points:
2
Sprint:
Sprint 229
sprint_count:
1
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Release Note Text:

Hide
Cause: A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh.

Consequence: This issue causes a client to fail authentication with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability.

Fix: update golang.org/x/crypto/ssh to v0.0.0-20220315160706-3147a52a75

Result: flaw is fixed.

Show
Cause: A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. Consequence: This issue causes a client to fail authentication with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability. Fix: update golang.org/x/crypto/ssh to v0.0.0-20220315160706-3147a52a75 Result: flaw is fixed.
Release Note Type:
CVE - Common Vulnerabilities and Exposures
Target Version:

4.11.z

Description of problem:

This is a clone of https://bugzilla.redhat.com/show_bug.cgi?id=2074299 for backporting purposes.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

1.
2.
3.

Actual results:

Expected results:

Additional info:

clones

OCPBUGS-3249 CVE-2022-27191 ose-installer-container: golang: crash in a golang.org/x/crypto/ssh server [openshift-4]

depends on

OCPBUGS-3249 CVE-2022-27191 ose-installer-container: golang: crash in a golang.org/x/crypto/ssh server [openshift-4]

links to