Skip to content
Fencer Vulns
high 7.5

CVE-2020-29652 json

golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability

published 2020-12-17 5 y ago modified 2026-09-10 1 mo ago also GHSA-3vm4-22fp-5rfm , GO-2021-0227 , EUVD-2022-2245

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

Patch / fix

  • go golang.org/x/crypto 0.0.0-20201216223049-8b5274cf687f
  • golang-go.crypto Debian 14, Debian 13, Debian 12 1:0.0~git20201221.eec23a3-1

debian advisories DEBIAN-CVE-2020-29652

  • golang-go.crypto Ubuntu 22.04 LTS 1:0.0~git20201221.eec23a3-1

ubuntu advisories UBUNTU-CVE-2020-29652

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-1.module+el8.4.0+10607+f4da7515
  • criu RHEL 8 3.15-1.module+el8.4.0+10607+f4da7515
  • crun RHEL 8 0.18-1.module+el8.4.0+10607+f4da7515
  • runc RHEL 8 1.0.0-70.rc92.module+el8.4.0+10607+f4da7515
  • udica RHEL 8 0.2.4-1.module+el8.4.0+10607+f4da7515
  • conmon RHEL 8 2:2.0.26-1.module+el8.4.0+10607+f4da7515
  • podman RHEL 8 3.0.1-6.module+el8.4.0+10607+f4da7515
  • skopeo RHEL 8 1:1.2.2-8.module+el8.4.0+10607+f4da7515

red hat advisories RHSA-2021:1796

  • velero openSUSE Tumbleweed 1.7.1-1.1

opensuse advisories openSUSE-SU-2024:11667-1

  • crit AlmaLinux 8 3.15-1.module_el8.6.0+2876+9ed4eae2
  • criu AlmaLinux 8 3.15-1.module_el8.6.0+2876+9ed4eae2
  • udica AlmaLinux 8 0.2.4-1.module_el8.6.0+2876+9ed4eae2
  • conmon AlmaLinux 8 2:2.0.26-1.module_el8.6.0+2876+9ed4eae2
  • libslirp AlmaLinux 8 4.3.1-1.module_el8.6.0+2876+9ed4eae2
  • slirp4netns AlmaLinux 8 1.1.8-1.module_el8.6.0+2876+9ed4eae2
  • python3-criu AlmaLinux 8 3.15-1.module_el8.6.0+2876+9ed4eae2
  • cockpit-podman AlmaLinux 8 29-2.module_el8.6.0+2876+9ed4eae2

almalinux advisories ALSA-2021:1796

  • criu Rocky Linux 8 3.15-1.module+el8.7.0+1076+9b1c11c1
  • criu Rocky Linux 8 3.15-1.module+el8.4.0+556+40122d08
  • criu Rocky Linux 8 3.15-1.module+el8.5.0+709+440d5e7e
  • criu Rocky Linux 8 3.15-1.module+el8.6.0+783+10209741
  • udica Rocky Linux 8 0.2.4-1.module+el8.7.0+1076+9b1c11c1
  • udica Rocky Linux 8 0.2.4-1.module+el8.4.0+556+40122d08
  • udica Rocky Linux 8 0.2.4-1.module+el8.5.0+709+440d5e7e
  • udica Rocky Linux 8 0.2.4-1.module+el8.6.0+783+10209741

rocky linux advisories RLSA-2021:1796

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-29652 updated cvss 7.5

golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference

  • Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, servicemesh-istioctl, servicemesh-pilot-agent, +2 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/multicluster-operators-subscription-rhel8, rhacm2/multicluster-operators-subscription-release-rhel8
    affected: no fix available
  • Red Hat Enterprise Linux 7 gomtree
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 csi-attacher, csi-provisioner, atomic-openshift, atomic-openshift-pod, csi-driver-registrar, atomic-openshift-node, +26 more Red Hat OpenShift Container Platform 4 podman, openshift, podman-tests, podman-docker, podman-remote, podman-gvproxy, +25 more Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8 Red Hat OpenShift Virtualization 2 virt-api-container, virt-handler-container, virt-launcher-container, virt-operator-container, virt-controller-container, kubernetes-nmstate-handler-container, +2 more Red Hat Storage 3 heketi, heketi-client, python-heketi
    affected: no fix available “Fix deferred”
  • Red Hat CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8 v4.8.0-18
    fixed: vendor fix RHSA-2021:2920
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-1.module+el8.4.0+10607+f4da7515, criu 3.15-1.module+el8.4.0+10607+f4da7515, crun 0.18-1.module+el8.4.0+10607+f4da7515, udica 0.2.4-1.module+el8.4.0+10607+f4da7515, podman 3.0.1-6.module+el8.4.0+10607+f4da7515, skopeo 1.2.2-8.module+el8.4.0+10607+f4da7515, +20 more
    fixed: vendor fix RHSA-2021:1796
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-installer v4.7.0-202102130115.p0, openshift4/ose-installer-artifacts v4.7.0-202102130115.p0, openshift4/ose-aws-ebs-csi-driver-rhel8 v4.7.0-202102130115.p0, openshift4/ose-azure-machine-controllers v4.7.0-202102130115.p0, openshift4/ose-baremetal-installer-rhel8 v4.7.0-202102130115.p0
    fixed: vendor fix RHSA-2020:5633
  • Red Hat OpenShift Container Platform 3.11 golang-github-openshift-oauth-proxy Red Hat OpenShift Container Platform 4 cri-o, openshift4/ose-cluster-bootstrap, openshift4/ose-cluster-autoscaler Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202102130115.p0, openshift4/ose-pod v4.7.0-202102130115.p0, openshift4/ose-etcd v4.7.0-202102130115.p0, openshift4/ose-tests v4.7.0-202102181036.p0, openshift4/ose-console v4.7.0-202102130115.p0, openshift4/ose-coredns v4.7.0-202102130115.p0, +125 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.18% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/crypto
<0.0.0-20201216223049-8b5274cf687f
0.0.0-20201216223049-8b5274cf687f

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.