Bug 2480680 (CVE-2026-39835)
| Summary: | CVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, akhatavk, akostadi, akoudelk, alebedev, amasferr, amctagga, anjoseph, anpicker, ansmith, anthomas, aoconnor, aos-team-art-private, aprice, aruklets, asdas, bdettelb, bniver, ckandaga, cmah, crizzo, dakwon, dhanak, dkeler, dmayorov, doconnor, dpaolell, drosa, dschmidt, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, fdeutsch, flucifre, gbenhaim, ggainey, gmeno, gparvin, groman, hasun, ibolton, jbalunas, jburrell, jcantril, jdelft, jfula, jjoyce, jkoehler, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jolong, jowilson, jpasqual, jprabhak, jpretori, jsamir, jschluet, jtolenti, jupierce, juwatts, kaycoth, kingland, kshier, lball, lbragsta, lgamliel, lgarciaa, lhh, lphiri, manissin, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mhulan, mnovotny, mstipich, mwringe, ngough, niyer, nmoumoul, nyancey, oezr, ometelka, orabin, oramraz, osousa, pahickey, pantinor, pcreech, peholase, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, ptisnovs, pvasanth, rchan, rekumar, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rojacob, sakbas, sausingh, sbratsla, sdawley, sghai, sidsharm, simaishi, slucidi, smallamp, smullick, sostapov, sseago, stcannon, sthirugn, stirabos, suppawar, syedriko, teagle, thason, tmalecek, tsedmik, tsze, twaugh, tzivkovi, vereddy, veshanka, vkarehfa, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2493463, 2493465, 2493467, 2493468, 2493469, 2493470, 2493472, 2493477, 2493478, 2493480, 2493485, 2493487, 2493489, 2493490, 2493492, 2493493, 2493494, 2493495, 2493496, 2493498, 2493502, 2493505, 2493507, 2493508, 2493510, 2493512, 2493514, 2493515, 2493516, 2493517, 2493518, 2493528, 2493530, 2493532, 2493533, 2493534, 2493538, 2493540, 2493541, 2493542, 2493547, 2493550, 2493551, 2493552, 2493554, 2493556, 2493462, 2493464, 2493466, 2493471, 2493473, 2493474, 2493475, 2493476, 2493479, 2493481, 2493482, 2493483, 2493484, 2493486, 2493488, 2493491, 2493497, 2493499, 2493500, 2493501, 2493503, 2493504, 2493506, 2493509, 2493511, 2493513, 2493519, 2493520, 2493521, 2493522, 2493523, 2493524, 2493525, 2493526, 2493527, 2493529, 2493531, 2493535, 2493536, 2493537, 2493539, 2493543, 2493544, 2493545, 2493546, 2493548, 2493549, 2493553 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-05-22 04:01:49 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:36199 https://access.redhat.com/errata/RHSA-2026:36199 This issue has been addressed in the following products: RHEM 1.0 for RHEL 9 Via RHSA-2026:36796 https://access.redhat.com/errata/RHSA-2026:36796 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:37072 https://access.redhat.com/errata/RHSA-2026:37072 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:37123 https://access.redhat.com/errata/RHSA-2026:37123 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:37410 https://access.redhat.com/errata/RHSA-2026:37410 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:38504 https://access.redhat.com/errata/RHSA-2026:38504 This issue has been addressed in the following products: RHEM 1.1 for RHEL 10 RHEM 1.1 for RHEL 9 Via RHSA-2026:41019 https://access.redhat.com/errata/RHSA-2026:41019 This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2026:48151 https://access.redhat.com/errata/RHSA-2026:48151 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.22 Via RHSA-2026:51036 https://access.redhat.com/errata/RHSA-2026:51036 |