CVE-2020-29652
- Dominant language
- Go
- Stars
- 25.6k
- Forks
- 2.4k
- PR merge metrics
- No merged PRs in 30d
Description
Used versions of golang.org/x/crypto in v12.1.8, v12.2.0-alpha and v12.2.0-alpha2 are vulnerable to CVE-2020-29652.
Short description: Nil Pointer Dereference in golang.org/x/crypto
Solution: Upgrade to version v0.0.0-20201216223049-8b5274cf687f or above.
Description: A nil pointer dereference in the `golang.org/x/crypto/ssh` component enables remote attackers to cause a DoS against SSH servers.
CVE-2020-29652
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
Contributor guide
Research direction
Start by locating the repository's dependency declaration for golang.org/x/crypto and review its use of the golang.org/x/crypto/ssh component. Verify the declared version against the CVE-2020-29652 affected versions and confirm that the resulting dependency resolves to the stated fixed version or later.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100