Overview
About vulnerability
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.Details
- Affected product:
- 42wim/httpsig , AlmaLinux 9.2 ESU , Azure/azure-amqp-common-go , Azure/azure-event-hubs-go , Azure/azure-pipeline-go , Azure/azure-sdk-for-go/sdk/azcore , Azure/azure-sdk-for-go/sdk/azidentity , Azure/azure-sdk-for-go/sdk/internal , Azure/azure-sdk-for-go/sdk/keyvault/azkeys , Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute , Azure/azure-sdk-for-go/sdk/resourcemanager/internal , Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups , Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork , Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources , Azure/azure-sdk-for-go/sdk/storage/azblob , Azure/azure-service-bus-go , Azure/azure-storage-blob-go , Azure/go-autorest/autorest , Azure/go-autorest/autorest/adal , Azure/go-autorest/autorest/azure/auth , Azure/go-autorest/autorest/azure/cli , Azure/kubelogin , FiloSottile/age , GoogleCloudPlatform/cloud-sql-proxy/cloudsql-proxy , GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric , Grafana , IBM/go-sdk-core , IBM/ibm-cos-sdk-go , IBM/sarama , Loki , Masterminds/sprig , PagerDuty/go-pagerduty , ProtonMail/go-crypto , TritonDataCenter/triton-go , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS , WireGuard/wgctrl-go/wgctrl , aead/minisign , apache/arrow/go , appscode/go , argocd , argoproj/notifications-engine , argoproj/pkg , benmathews/bench , bketelsen/crypt , bufbuild/protoc-gen-validate , bwmarrin/discordgo , caddyserver/caddy , caddyserver/certmagic , census-ecosystem/opencensus-go-exporter-ocagent/ocagent , census-instrumentation/opencensus-go , census-instrumentation/opencensus-proto , centrifugal/centrifuge , cloud.google.com/go , cloud.google.com/go/accessapproval , cloud.google.com/go/accesscontextmanager , cloud.google.com/go/aiplatform , cloud.google.com/go/analytics , cloud.google.com/go/apigateway , cloud.google.com/go/apigeeconnect , cloud.google.com/go/apigeeregistry , cloud.google.com/go/appengine , cloud.google.com/go/area120 , cloud.google.com/go/artifactregistry , cloud.google.com/go/asset , cloud.google.com/go/assuredworkloads , cloud.google.com/go/auth , cloud.google.com/go/automl , cloud.google.com/go/baremetalsolution , cloud.google.com/go/batch , cloud.google.com/go/beyondcorp , cloud.google.com/go/bigquery , cloud.google.com/go/bigtable , cloud.google.com/go/billing , cloud.google.com/go/binaryauthorization , cloud.google.com/go/certificatemanager , cloud.google.com/go/channel , cloud.google.com/go/cloudbuild , cloud.google.com/go/clouddms , cloud.google.com/go/cloudtasks , cloud.google.com/go/compute , cloud.google.com/go/contactcenterinsights , cloud.google.com/go/container , cloud.google.com/go/containeranalysis , cloud.google.com/go/datacatalog , cloud.google.com/go/dataflow , cloud.google.com/go/dataform , cloud.google.com/go/datafusion , cloud.google.com/go/datalabeling , cloud.google.com/go/dataplex , cloud.google.com/go/dataproc , cloud.google.com/go/dataqna , cloud.google.com/go/datastore , cloud.google.com/go/datastream , cloud.google.com/go/deploy , cloud.google.com/go/dialogflow , cloud.google.com/go/dlp , cloud.google.com/go/documentai , cloud.google.com/go/domains , cloud.google.com/go/edgecontainer , cloud.google.com/go/essentialcontacts , cloud.google.com/go/eventarc , cloud.google.com/go/filestore , cloud.google.com/go/firestore , cloud.google.com/go/functions , cloud.google.com/go/gkebackup , cloud.google.com/go/gkeconnect , cloud.google.com/go/gkehub , cloud.google.com/go/gkemulticloud , cloud.google.com/go/grafeas , cloud.google.com/go/gsuiteaddons , cloud.google.com/go/iam , cloud.google.com/go/iap , cloud.google.com/go/ids , cloud.google.com/go/iot , cloud.google.com/go/kms , cloud.google.com/go/language , cloud.google.com/go/lifesciences , cloud.google.com/go/logging , cloud.google.com/go/longrunning , cloud.google.com/go/managedidentities , cloud.google.com/go/maps , cloud.google.com/go/mediatranslation , cloud.google.com/go/memcache , cloud.google.com/go/metastore , cloud.google.com/go/monitoring , cloud.google.com/go/networkconnectivity , cloud.google.com/go/networkmanagement , cloud.google.com/go/networksecurity , cloud.google.com/go/notebooks , cloud.google.com/go/optimization , cloud.google.com/go/orchestration , cloud.google.com/go/orgpolicy , cloud.google.com/go/osconfig , cloud.google.com/go/oslogin , cloud.google.com/go/phishingprotection , cloud.google.com/go/policytroubleshooter , cloud.google.com/go/privatecatalog , cloud.google.com/go/pubsub , cloud.google.com/go/pubsublite , cloud.google.com/go/recaptchaenterprise , cloud.google.com/go/recommendationengine , cloud.google.com/go/recommender , cloud.google.com/go/redis , cloud.google.com/go/resourcemanager , cloud.google.com/go/resourcesettings , cloud.google.com/go/retail , cloud.google.com/go/run , cloud.google.com/go/scheduler , cloud.google.com/go/secretmanager , cloud.google.com/go/security , cloud.google.com/go/securitycenter , cloud.google.com/go/servicedirectory , cloud.google.com/go/shell , cloud.google.com/go/spanner , cloud.google.com/go/speech , cloud.google.com/go/storage , cloud.google.com/go/storagetransfer , cloud.google.com/go/talent , cloud.google.com/go/texttospeech , cloud.google.com/go/tpu , cloud.google.com/go/trace , cloud.google.com/go/translate , cloud.google.com/go/video , cloud.google.com/go/videointelligence , cloud.google.com/go/vision , cloud.google.com/go/vmmigration , cloud.google.com/go/vmwareengine , cloud.google.com/go/vpcaccess , cloud.google.com/go/webrisk , cloud.google.com/go/websecurityscanner , cloud.google.com/go/workflows , cloudflare/circl , cncf/xds/go , containerd/continuity , coredns/coredns , coreos/go-oidc , cortexproject/cortex , crewjam/saml , davidmz/go-pageant , denisenkom/go-mssqldb , drone-runners/drone-runner-docker , drone/runner-go , envoyproxy/go-control-plane , etcd-io/etcd , etcd-io/etcd/api , etcd-io/etcd/client , etcd-io/etcd/server , filippo.io/age , fraugster/parquet-go , fsouza/fake-gcs-server , getsentry/sentry-go , gitea/go-sdk/gitea , github.com/Azure/azure-amqp-common-go , github.com/Azure/azure-event-hubs-go , github.com/Azure/azure-sdk-for-go/sdk/azcore , github.com/Azure/azure-sdk-for-go/sdk/azidentity , github.com/Azure/azure-sdk-for-go/sdk/internal , github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys , github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute , github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal , github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups , github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork , github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources , github.com/Azure/azure-sdk-for-go/sdk/storage/azblob , github.com/Azure/azure-service-bus-go , github.com/Azure/azure-storage-blob-go , github.com/Azure/go-autorest/autorest , github.com/Azure/go-autorest/autorest/adal , github.com/Azure/go-autorest/autorest/azure/auth , github.com/Azure/go-autorest/autorest/azure/cli , github.com/GoogleCloudPlatform/cloudsql-proxy , github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric , github.com/IBM/go-sdk-core , github.com/IBM/ibm-cos-sdk-go , github.com/IBM/sarama , github.com/Masterminds/sprig , github.com/ProtonMail/go-crypto , github.com/Shopify/sarama , github.com/apache/arrow/go , github.com/benmathews/bench , github.com/bketelsen/crypt , github.com/caddyserver/caddy , github.com/census-instrumentation/opencensus-proto , github.com/centrifugal/centrifuge , github.com/cloudflare/circl , github.com/cncf/xds/go , github.com/coredns/coredns , github.com/coreos/go-oidc , github.com/cortexproject/cortex , github.com/crewjam/saml , github.com/deepmap/oapi-codegen , github.com/denisenkom/go-mssqldb , github.com/envoyproxy/protoc-gen-validate , github.com/fsouza/fake-gcs-server , github.com/getsentry/sentry-go , github.com/go-acme/lego , github.com/go-jose/go-jose , github.com/go-kit/kit , github.com/go-ldap/ldap , github.com/go-openapi/analysis , github.com/go-openapi/loads , github.com/go-openapi/runtime , github.com/go-openapi/strfmt , github.com/go-openapi/validate , github.com/go-playground/validator , github.com/gobuffalo/genny , github.com/goccy/go-yaml , github.com/gogo/protobuf , github.com/golang-migrate/migrate , github.com/golang/mock , github.com/golang/protobuf , github.com/google/go-github , github.com/google/s2a-go , github.com/googleapis/enterprise-certificate-proxy , github.com/googleapis/gax-go , github.com/googleapis/google-cloud-go-testing , github.com/gopcua/opcua , github.com/gophercloud/gophercloud , github.com/grafana/alerting , github.com/grafana/authlib , github.com/grafana/dskit , github.com/grafana/e2e , github.com/grafana/grafana-aws-sdk , github.com/grafana/grafana-azure-sdk-go , github.com/grafana/grafana-cloud-migration-snapshot , github.com/grafana/grafana/pkg/aggregator , github.com/grafana/grafana/pkg/apimachinery , github.com/grafana/grafana/pkg/storage/unified/apistore , github.com/grafana/grafana/pkg/storage/unified/resource , github.com/grafana/sqlds , github.com/grafana/tempo , github.com/grpc-ecosystem/go-grpc-middleware , github.com/gulducat/go-run-programs , github.com/hashicorp/consul , github.com/hashicorp/consul/api , github.com/hashicorp/go-discover , github.com/hashicorp/go-secure-stdlib/password , github.com/hashicorp/go-sockaddr , github.com/hashicorp/hcdiag , github.com/hashicorp/hcl , github.com/hashicorp/mdns , github.com/hashicorp/memberlist , github.com/hashicorp/raft-wal , github.com/hashicorp/serf , github.com/hashicorp/vault-plugin-auth-alicloud , github.com/hashicorp/vault/api , github.com/hashicorp/vault/api/auth/gcp , github.com/hashicorp/vault/sdk , github.com/heroku/x , github.com/influxdata/influxdb , github.com/influxdata/influxdb-client-go , github.com/influxdata/telegraf , github.com/jackc/pgconn , github.com/jackc/pgmock , github.com/jackc/pgtype , github.com/jackc/pgx , github.com/jcmturner/gokrb5 , github.com/joyent/triton-go , github.com/kataras/iris , github.com/labstack/echo , github.com/lucas-clemente/quic-go , github.com/lyft/protoc-gen-star , github.com/marten-seemann/qtls , github.com/mholt/certmagic , github.com/microsoft/go-mssqldb , github.com/minio/minio-go , github.com/mitchellh/cli , github.com/mithrandie/csvq , github.com/mithrandie/csvq-driver , github.com/nats-io/nats-server , github.com/nats-io/nats-streaming-server , github.com/nats-io/nats.go , github.com/nats-io/nkeys , github.com/oapi-codegen/runtime , github.com/openfga/openfga , github.com/openzipkin-contrib/zipkin-go-opentracing , github.com/openzipkin/zipkin-go , github.com/pkg/sftp , github.com/pressly/goose , github.com/prometheus/alertmanager , github.com/prometheus/client_golang , github.com/prometheus/common , github.com/prometheus/exporter-toolkit , github.com/prometheus/prometheus , github.com/sacloud/libsacloud , github.com/sagikazarmark/crypt , github.com/spf13/afero , github.com/spf13/cobra , github.com/spf13/viper , github.com/substrait-io/substrait-go , github.com/thanos-io/objstore , github.com/thanos-io/thanos , github.com/twmb/franz-go , github.com/twmb/franz-go/pkg/kadm , github.com/twmb/franz-go/pkg/kfake , go-acme/lego , go-fed/httpsig , go-git/go-git , go-jose/go-jose , go-kit/kit , go-ldap/ldap , go-openapi/analysis , go-openapi/loads , go-openapi/runtime , go-openapi/strfmt , go-openapi/validate , go-playground/validator , go.etcd.io/etcd , go.etcd.io/etcd/client , go.etcd.io/etcd/server , go.mongodb.org/mongo-driver , go.opencensus.io , go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc , gobuffalo/envy , gobuffalo/genny , gobuffalo/logger , gobuffalo/packr , gobuffalo/plushgen , gobuffalo/pop , goccy/go-yaml , gocloud.dev , goftp/server , gogo/protobuf , golang-migrate/migrate , golang.org/x/crypto , golang.org/x/mod , golang.org/x/net , golang.org/x/tools , golang.zx2c4.com/wireguard , golang.zx2c4.com/wireguard/wgctrl , golang/mock , golang/protobuf , gomodules/notify , google.golang.org/api , google.golang.org/genproto , google.golang.org/grpc , google.golang.org/protobuf , google/go-cloud , google/go-github , google/s2a-go , googleapis/enterprise-certificate-proxy , googleapis/gax-go , googleapis/go-genproto , googleapis/google-api-go-client , googleapis/google-cloud-go , googleapis/google-cloud-go-testing , googleapis/google-cloud-go/accessapproval , googleapis/google-cloud-go/accesscontextmanager , googleapis/google-cloud-go/aiplatform , googleapis/google-cloud-go/analytics , googleapis/google-cloud-go/apigateway , googleapis/google-cloud-go/apigeeconnect , googleapis/google-cloud-go/apigeeregistry , googleapis/google-cloud-go/appengine , googleapis/google-cloud-go/area120 , googleapis/google-cloud-go/artifactregistry , googleapis/google-cloud-go/asset , googleapis/google-cloud-go/assuredworkloads , googleapis/google-cloud-go/auth , googleapis/google-cloud-go/automl , googleapis/google-cloud-go/baremetalsolution , googleapis/google-cloud-go/batch , googleapis/google-cloud-go/beyondcorp , googleapis/google-cloud-go/bigquery , googleapis/google-cloud-go/bigtable , googleapis/google-cloud-go/billing , googleapis/google-cloud-go/binaryauthorization , googleapis/google-cloud-go/certificatemanager , googleapis/google-cloud-go/channel , googleapis/google-cloud-go/cloudbuild , googleapis/google-cloud-go/clouddms , googleapis/google-cloud-go/cloudtasks , googleapis/google-cloud-go/compute , googleapis/google-cloud-go/contactcenterinsights , googleapis/google-cloud-go/container , googleapis/google-cloud-go/containeranalysis , googleapis/google-cloud-go/datacatalog , googleapis/google-cloud-go/dataflow , googleapis/google-cloud-go/dataform , googleapis/google-cloud-go/datafusion , googleapis/google-cloud-go/datalabeling , googleapis/google-cloud-go/dataplex , googleapis/google-cloud-go/dataproc , googleapis/google-cloud-go/dataqna , googleapis/google-cloud-go/datastore , googleapis/google-cloud-go/datastream , googleapis/google-cloud-go/deploy , googleapis/google-cloud-go/dialogflow , googleapis/google-cloud-go/dlp , googleapis/google-cloud-go/documentai , googleapis/google-cloud-go/domains , googleapis/google-cloud-go/edgecontainer , googleapis/google-cloud-go/essentialcontacts , googleapis/google-cloud-go/eventarc , googleapis/google-cloud-go/filestore , googleapis/google-cloud-go/firestore , googleapis/google-cloud-go/functions , googleapis/google-cloud-go/gkebackup , googleapis/google-cloud-go/gkeconnect , googleapis/google-cloud-go/gkehub , googleapis/google-cloud-go/gkemulticloud , googleapis/google-cloud-go/grafeas , googleapis/google-cloud-go/gsuiteaddons , googleapis/google-cloud-go/iam , googleapis/google-cloud-go/iap , googleapis/google-cloud-go/ids , googleapis/google-cloud-go/iot , googleapis/google-cloud-go/kms , googleapis/google-cloud-go/language , googleapis/google-cloud-go/lifesciences , googleapis/google-cloud-go/logging , googleapis/google-cloud-go/longrunning , googleapis/google-cloud-go/managedidentities , googleapis/google-cloud-go/maps , googleapis/google-cloud-go/mediatranslation , googleapis/google-cloud-go/memcache , googleapis/google-cloud-go/metastore , googleapis/google-cloud-go/monitoring , googleapis/google-cloud-go/networkconnectivity , googleapis/google-cloud-go/networkmanagement , googleapis/google-cloud-go/networksecurity , googleapis/google-cloud-go/notebooks , googleapis/google-cloud-go/optimization , googleapis/google-cloud-go/orchestration , googleapis/google-cloud-go/orgpolicy , googleapis/google-cloud-go/osconfig , googleapis/google-cloud-go/oslogin , googleapis/google-cloud-go/phishingprotection , googleapis/google-cloud-go/policytroubleshooter , googleapis/google-cloud-go/privatecatalog , googleapis/google-cloud-go/pubsub , googleapis/google-cloud-go/pubsublite , googleapis/google-cloud-go/recaptchaenterprise , googleapis/google-cloud-go/recommendationengine , googleapis/google-cloud-go/recommender , googleapis/google-cloud-go/redis , googleapis/google-cloud-go/resourcemanager , googleapis/google-cloud-go/resourcesettings , googleapis/google-cloud-go/retail , googleapis/google-cloud-go/run , googleapis/google-cloud-go/scheduler , googleapis/google-cloud-go/secretmanager , googleapis/google-cloud-go/security , googleapis/google-cloud-go/securitycenter , googleapis/google-cloud-go/servicedirectory , googleapis/google-cloud-go/shell , googleapis/google-cloud-go/spanner , googleapis/google-cloud-go/speech , googleapis/google-cloud-go/storage , googleapis/google-cloud-go/storagetransfer , googleapis/google-cloud-go/talent , googleapis/google-cloud-go/texttospeech , googleapis/google-cloud-go/tpu , googleapis/google-cloud-go/trace , googleapis/google-cloud-go/translate , googleapis/google-cloud-go/video , googleapis/google-cloud-go/videointelligence , googleapis/google-cloud-go/vision , googleapis/google-cloud-go/vmmigration , googleapis/google-cloud-go/vmwareengine , googleapis/google-cloud-go/vpcaccess , googleapis/google-cloud-go/webrisk , googleapis/google-cloud-go/websecurityscanner , googleapis/google-cloud-go/workflows , googlesource/crypto , googlesource/mod , googlesource/net , googlesource/protobuf , googlesource/tools , gopcua/opcua , gophercloud/gophercloud , gopkg.in/macaron.v1 , gopkg.in/telebot.v3 , grafana/alerting , grafana/authlib , grafana/dskit , grafana/e2e , grafana/grafana-app-sdk , grafana/grafana-aws-sdk , grafana/grafana-azure-sdk-go , grafana/grafana-cloud-migration-snapshot , grafana/grafana-openapi-client-go , grafana/grafana-plugin-sdk-go , grafana/grafana/apps/playlist , grafana/grafana/pkg/aggregator , grafana/grafana/pkg/apimachinery , grafana/grafana/pkg/apiserver , grafana/grafana/pkg/promlib , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/kindsys , grafana/sqlds , grafana/tempo , grafana/thema , grpc-ecosystem/go-grpc-middleware , grpc-ecosystem/go-grpc-prometheus , grpc/grpc-go , gulducat/go-run-programs , hashicorp/consul , hashicorp/consul/api , hashicorp/go-discover , hashicorp/go-secure-stdlib/password , hashicorp/go-sockaddr , hashicorp/hcdiag , hashicorp/hcl , hashicorp/mdns , hashicorp/memberlist , hashicorp/raft-wal , hashicorp/serf , hashicorp/vault-plugin-auth-alicloud , hashicorp/vault/api , hashicorp/vault/api/auth/gcp , hashicorp/vault/sdk , heroku/x , influxdata/influxdb , influxdata/influxdb-client-go , influxdata/telegraf , jackc/pgconn , jackc/pgmock , jackc/pgtype , jackc/pgx , jcmturner/gokrb5 , k8s.io/apiserver , k8s.io/client-go , k8s.io/component-base , k8s.io/kube-aggregator , kataras/iris , kubernetes/apiextensions-apiserver , kubernetes/apiserver , kubernetes/client-go , kubernetes/component-base , kubernetes/controller-manager , kubernetes/kube-aggregator , kubernetes/kubernetes , labstack/echo , lestrrat-go/jwx , lyft/protoc-gen-star , marten-seemann/qtls , mattn/go-ieproxy , microsoft/go-mssqldb , minio , minio/colorjson , minio/madmin-go , minio/mc , minio/minio-go , minio/object-browser/console , minio/pkg , minio/selfupdate , minio/sio , mitchellh/cli , mithrandie/csvq , mithrandie/csvq-driver , mongodb/mongo-go-driver , nats-io/jwt , nats-io/nats-server , nats-io/nats-streaming-server , nats-io/nats.go , nats-io/nkeys , nats-io/stan.go , oapi-codegen/oapi-codegen , oapi-codegen/runtime , open-telemetry/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace/otlptracegrpc , openfga/openfga , openzipkin-contrib/zipkin-go-opentracing , openzipkin/zipkin-go , ory/dockertest , ory/fosite , ory/go-acc , ory/jsonschema , ory/viper , ory/x , pkg/sftp , pressly/goose , prometheus/alertmanager , prometheus/client_golang , prometheus/common , prometheus/common/sigv4 , prometheus/exporter-toolkit , prometheus/prom2json , prometheus/prometheus , quic-go/quic-go , sacloud/libsacloud , sagikazarmark/crypt , secure-io/sio-go , skeema/knownhosts , spf13/afero , spf13/cobra , spf13/viper , spiffe/go-spiffe , square/go-jose , substrait-io/substrait-go , thanos-io/objstore , thanos-io/thanos , twmb/franz-go , twmb/franz-go/pkg/kadm , twmb/franz-go/pkg/kfake , twmb/franz-go/plugin/kprom , xanzy/ssh-agent , zx2c4/wireguard-go
- Affected packages:
- golang.org/x/crypto @ 0.5.0 (+1387 more)