Skip to content
Fencer Intel
high 7.5

CVE-2022-27191 json

golang.org/x/crypto/ssh Denial of service via crafted Signer

published 4y ago modified last mo. also GHSA-8c26-wmh5-6g9v , GO-2021-0356 , EUVD-2022-1373

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

Patch / fix

  • go golang.org/x/crypto 0.0.0-20220314234659-1baeb1ce4c0b
  • golang ssh 0.0.0-20220314234659-1baeb1ce4c0b
  • golang-go.crypto Debian 14, Debian 13, Debian 12 1:0.0~git20220315.3147a52-1

debian advisories DEBIAN-CVE-2022-27191

  • crit RHEL 8 3.15-3.module+el8.7.0+16772+33343656
  • criu RHEL 8 3.15-3.module+el8.7.0+16772+33343656
  • crun RHEL 8 1.5-1.module+el8.7.0+16772+33343656
  • runc RHEL 8 1:1.1.4-1.module+el8.7.0+16772+33343656
  • udica RHEL 8 0.2.6-3.module+el8.7.0+16772+33343656
  • conmon RHEL 8 3:2.1.4-1.module+el8.7.0+16772+33343656
  • podman RHEL 8 3:4.2.0-1.module+el8.7.0+16772+33343656
  • skopeo RHEL 8 2:1.9.2-1.module+el8.7.0+16772+33343656

red hat advisories RHSA-2022:7457RHSA-2022:7469RHSA-2023:1325RHSA-2023:3366RHSA-2022:8932RHSA-2022:8008

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • rhnlib Manager Client Tools 12-BETA 5.0.1-24.30.3
  • grafana Manager Client Tools 12-BETA 9.5.8-4.21.2
  • mgr-push Manager Client Tools 12-BETA 5.0.1-4.21.4
  • spacecmd Manager Client Tools 12-BETA 5.0.1-41.42.3
  • python-hwdata Manager Client Tools 12-BETA 2.3.5-15.12.2
  • uyuni-common-libs Manager Client Tools 12-BETA 5.0.1-3.33.3
  • kiwi-desc-saltboot Manager Client Tools 12-BETA 0.1.1687520761.cefb248-4.15.2

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2024:0191-1SUSE-SU-2023:2579-1SUSE-SU-2023:2187-1SUSE-EL-9-CLIENT-TOOLS-2023-2185

  • coredns Package Hub 15 SP6, openSUSE Leap 15.6 1.11.3-bp156.4.3.1
  • podman openSUSE Tumbleweed 4.2.1-2.1
  • coredns openSUSE Tumbleweed 1.10.0-1.1
  • containerd openSUSE Tumbleweed 1.6.9-1.1
  • golang-github-prometheus-node_exporter openSUSE Tumbleweed 1.5.0-1.1
  • velero openSUSE Tumbleweed 1.11.1-1.1

opensuse advisories openSUSE-SU-2024:0319-1openSUSE-SU-2024:12400-1openSUSE-SU-2024:12490-1openSUSE-SU-2024:12550-1openSUSE-SU-2024:12637-1openSUSE-SU-2024:13225-1

  • podman AlmaLinux 9 2:4.2.0-3.el9
  • podman-tests AlmaLinux 9 2:4.2.0-3.el9
  • podman-docker AlmaLinux 9 2:4.2.0-3.el9
  • podman-remote AlmaLinux 9 2:4.2.0-3.el9
  • podman-gvproxy AlmaLinux 9 2:4.2.0-3.el9
  • podman-plugins AlmaLinux 9 2:4.2.0-3.el9
  • buildah AlmaLinux 9 1:1.27.0-2.el9
  • buildah-tests AlmaLinux 9 1:1.27.0-2.el9

almalinux advisories ALSA-2022:7954ALSA-2022:8008ALSA-2022:7469

  • criu Rocky Linux 8 3.15-3.module+el8.7.0+1077+0e4f03d4
  • criu Rocky Linux 8 3.15-3.module+el8.5.0+710+4c471e88
  • criu Rocky Linux 8 3.15-3.module+el8.6.0+1054+50b00ff4
  • crun Rocky Linux 8 1.5-1.module+el8.7.0+1077+0e4f03d4
  • crun Rocky Linux 8 1.5-1.module+el8.6.0+1054+50b00ff4
  • runc Rocky Linux 8 1:1.1.4-1.module+el8.7.0+1077+0e4f03d4
  • udica Rocky Linux 8 0.2.6-3.module+el8.7.0+1077+0e4f03d4
  • udica Rocky Linux 8 0.2.6-3.module+el8.6.0+971+69b94baf

rocky linux advisories RLSA-2022:7469RLSA-2022:7457

  • go Alpine 3.14 1.16.15-r0
  • podman Alpine 3.15 3.4.6-r0
  • coredns Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.9.3-r0
  • git-lfs Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 3.1.2-r4

alpine advisories ALPINE-CVE-2022-27191

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2022-27191 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-27191 updated cvss 7.5

golang: crash in a golang.org/x/crypto/ssh server

  • Red Hat Migration Toolkit for Containers cpma, rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-controller-rhel8
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services odo
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-istioctl, servicemesh-pilot-agent, servicemesh-pilot-discovery Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/openshift-hive-rhel8, rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/multicluster-operators-subscription-rhel8, rhacm2/multicluster-operators-subscription-release-rhel8
    affected: no fix available
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 podman, openshift, podman-tests, podman-docker, podman-remote, podman-gvproxy, +20 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8
    affected: no fix planned “Out of support scope”
  • Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/applicationset-rhel8 Red Hat OpenShift Virtualization 2 kubevirt, kubemacpool-container, virt-launcher-container, cluster-network-addons-operator-container, hyperconverged-cluster-operator-container
    affected: no fix planned “Will not fix”
show 14 more
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-launcher, container-native-virtualization/libguestfs-tools, container-native-virtualization/cluster-network-addons-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-openshift-bridge-rhel8-operator, quay/quay-container-security-operator-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat CNV 4.11 for RHEL 7 kubevirt 4.11.0-643.el7, kubevirt-virtctl 4.11.0-643.el7, kubevirt-virtctl-redistributable 4.11.0-643.el7 Red Hat CNV 4.11 for RHEL 8 kubevirt 4.11.0-643.el8, kubevirt-virtctl 4.11.0-643.el8, kubevirt-virtctl-redistributable 4.11.0-643.el8
    fixed: vendor fix RHSA-2022:6527
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.1-20
    fixed: vendor fix RHSA-2022:8634
  • Red Hat Ceph Storage 8.1 rhceph/grafana-rhel9 1791176238
    fixed: vendor fix RHSA-2026:79243
  • Red Hat Enterprise Linux AppStream (v. 8) crun 1.5-1.module+el8.7.0+16520+2db5507d, crun 1.5-1.module+el8.7.0+16772+33343656, crit 3.15-3.module+el8.7.0+16520+2db5507d, crit 3.15-3.module+el8.7.0+16772+33343656, criu 3.15-3.module+el8.7.0+16520+2db5507d, criu 3.15-3.module+el8.7.0+16772+33343656, +60 more
    fixed: vendor fix RHSA-2022:7469
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.2.0-3.el9, buildah 1.27.0-2.el9, podman-tests 4.2.0-3.el9, podman-docker 4.2.0-3.el9, podman-remote 4.2.0-3.el9, buildah-tests 1.27.0-2.el9, +2 more
    fixed: vendor fix RHSA-2022:8008
  • Red Hat OpenShift Container Platform 4.11 cri-o 1.24.1-11.rhaos4.11.gitb0d2ef3.el8, openshift4-wincw/windows-machine-config-rhel8-operator 6.0.1-38, openshift4/ose-installer v4.11.0-202212070956.p0.g7e60d78.assembly.stream, openshift4/ose-installer-artifacts v4.11.0-202212202214.p0.gd3fb15a.assembly.stream, openshift4/ose-csi-driver-nfs-rhel8 v4.11.0-202208020235.p0.gf144bb4.assembly.stream, openshift4/ose-csi-driver-manila-rhel8 v4.11.0-202208020235.p0.g246ae15.assembly.stream, +9 more
    fixed: vendor fix RHSA-2022:5068
  • Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-rhel8-operator 7.0.0-22, openshift4/ose-node-feature-discovery v4.12.0-202301042354.p0.g5e2696b.assembly.stream
    fixed: vendor fix RHSA-2022:9096
  • Red Hat OpenShift Container Platform 4.13 openshift-clients 4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8, openshift-clients 4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9, openshift-clients 4.13.0-202305291355.p0.g1024efc.assembly.stream.el8, openshift-clients 4.13.0-202305291355.p0.g1024efc.assembly.stream.el9, openshift4/ose-installer v4.13.0-202305091542.p0.g44db7b2.assembly.stream, openshift-clients-redistributable 4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8, +3 more
    fixed: vendor fix RHSA-2023:1325
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.5.0-3.el8
    fixed: vendor fix RHSA-2022:8932
  • Red Hat OpenShift Serverless 1.26 openshift-serverless-1/client-kn-rhel8 1.5.0-3, openshift-serverless-1/func-utils-rhel8 1.26.0-1, openshift-serverless-1/serving-queue-rhel8 1.5.0-2, openshift-serverless-1/eventing-mtping-rhel8 1.5.0-2, openshift-serverless-1/kourier-control-rhel8 1.5.0-1, openshift-serverless-1/serving-webhook-rhel8 1.5.0-2, +31 more
    fixed: vendor fix RHSA-2022:8938
  • Red Hat RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.1.0-13
    fixed: vendor fix RHSA-2023:3943
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 pysnmp 4.4.8-3.el8, pyparsing 2.3.1-2.el8, libsodium 1.0.16-5.el8, python-pbr 5.5.1-2.el8, python-yappi 1.0-3.el8, python-amqp 2.5.2-8.el8, +273 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 tox 3.23.0-2.el9.1, crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, future 0.18.2-9.el9.1, subunit 1.4.0-6.el9.1, pyflakes 2.2.0-3.el9.1, +471 more Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-rhel8-operator 1.1.1-22, oadp/oadp-operator-bundle 1.1.1-41, oadp/oadp-mustgather-rhel8 1.1.1-29, oadp/oadp-velero-plugin-rhel8 1.1.1-16, oadp/oadp-velero-plugin-for-aws-rhel8 1.1.1-16, oadp/oadp-velero-plugin-for-csi-rhel8 1.1.1-23, +5 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/agent-service-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-scanner-db-rhel8 Red Hat Ceph Storage 8.1 rhceph/rhceph-8-rhel9 1791176990, rhceph/keepalived-rhel9 1791175257, rhceph/oauth2-proxy-rhel9 1791176282, rhceph/snmp-notifier-rhel9 1791176336, rhceph/rhceph-haproxy-rhel9 1791176338, rhceph/rhceph-promtail-rhel9 1791176366
    +8 more products
    Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more Red Hat OpenShift Container Platform 4 openshift4/ose-node-problem-detector-rhel8 Red Hat OpenShift Container Platform 4.11 buildah 1.23.4-2.el8, haproxy 2.2.24-1.el8, haproxy22 2.2.24-1.el8, cri-tools 1.24.2-4.1.el8, crit 3.15-4.rhaos4.11.el8, criu 3.15-4.rhaos4.11.el8, +436 more Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-operator-bundle v7.0.0-24, openshift4/ose-ptp v4.12.0-202301050335.p0.gb9cbcd0.assembly.stream, openshift4/frr-rhel8 v4.12.0-202212061458.p0.g1c36ecd.assembly.stream, openshift4/metallb-rhel8 v4.12.0-202301042354.p0.g388ac00.assembly.stream, openshift4/ose-sriov-cni v4.12.0-202301042354.p0.gbf74bbd.assembly.stream, openshift4/ose-descheduler v4.12.0-202301042354.p0.ge8e0600.assembly.stream, +57 more Red Hat OpenShift Container Platform 4.13 tini 0.16.1-1.el8ar, grpc 1.18.0-4.el8ost, python-rsa 4.7-1.el8, python3-rsa 4.7-1.el8, cri-tools 1.26.0-1.el9, cri-tools 1.26.0-2.el9, +530 more Red Hat OpenShift Virtualization 4 container-native-virtualization/hyperconverged-cluster-webhook-rhel8 Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-operator Red Hat RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-roxctl-rhel8 4.1.0-9, advanced-cluster-security/rhacs-scanner-rhel8 4.1.0-10, advanced-cluster-security/rhacs-rhel8-operator 4.1.0-10, advanced-cluster-security/rhacs-central-db-rhel8 4.1.0-8, advanced-cluster-security/rhacs-collector-rhel8 4.1.0-11, advanced-cluster-security/rhacs-operator-bundle 4.1.0-14, +4 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.96% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/crypto
<0.0.0-20220314234659-1baeb1ce4c0b
0.0.0-20220314234659-1baeb1ce4c0b

Classification

Weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.