Skip to content
OpenAdvisories
High DLA-2402-1 3 CVEs

golang-go.crypto - security update

Published Oct 8, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 golang-go.crypto 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1

Vulnerabilities 3

  • High 7.5
    CVE-2020-9283 Public exploit EPSS 21%

    Improper Verification of Cryptographic Signature in golang.org/x/crypto

    golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

    k3d k3d-proxy k3d-tools golang.org/x/crypto Debian Ubuntu Wolfi Go
  • Medium 5.9
    CVE-2019-11840

    golang.org/x/crypto/salsa20/salsa uses insufficiently random values

    An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa package…

    k3d k3d-proxy k3d-tools snapd Debian Ubuntu Wolfi Go
  • Medium 5.9
    CVE-2019-11841

    Golang/x/crypto message forgery vulnerability

    A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or m…

    k3d k3d-proxy k3d-tools golang.org/x/crypto Debian Ubuntu Wolfi Go