Bug 2415997 (CVE-2025-58181)
| Summary: | CVE-2025-58181 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, alcohan, alebedev, amctagga, anjoseph, ansmith, aoconnor, bdettelb, bniver, carogers, cmah, crizzo, dakwon, dhanak, dkeler, doconnor, drosa, dschmidt, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, erezende, fdeutsch, flucifre, gmeno, gparvin, groman, haoli, hkataria, jajackso, jbalunas, jburrell, jcammara, jeder, jjoyce, jkoehler, jlanda, jmatthew, jmitchel, jneedle, jolong, jprabhak, jpretori, jschluet, kegrant, kingland, koliveir, kshier, kverlaen, lball, lhh, lphiri, mabashia, manissin, matzew, mbenjamin, mburns, mgarciac, mhackett, mnovotny, ngough, oramraz, owatkins, pahickey, pbraun, peholase, pjindal, rhaigner, rhel-process-autobot, rjohnson, sausingh, sdawley, shvarugh, simaishi, smcdonal, smullick, sostapov, stcannon, stirabos, suppawar, teagle, tfister, thason, thavo, vereddy, veshanka, vkarehfa, watson-tool-maintainers, whayutin, wtam, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in golang.org/x/crypto/ssh. An attacker can exploit this vulnerability by sending specially crafted GSSAPI (Generic Security Service Application Program Interface) authentication requests to an SSH (Secure Shell) server. The server fails to validate the number of mechanisms specified in these requests, leading to unbounded memory consumption. This can result in a Denial of Service (DoS), making the SSH server unavailable to legitimate users.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2424423, 2424424, 2424425, 2424426 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-11-19 21:01:19 UTC
|