Search for vulnerabilities
Vulnerability details: VCID-8j9x-rjkk-c3d9
Vulnerability ID VCID-8j9x-rjkk-c3d9
Aliases CVE-2020-29652
GHSA-3vm4-22fp-5rfm
Summary golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. An attacker can craft an authentication request message for the `gssapi-with-mic` method which will cause NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-476 NULL Pointer Dereference
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-29652.json
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
cvssv3.1 7.5 https://go.dev/cl/278852
generic_textual HIGH https://go.dev/cl/278852
cvssv3.1 7.5 https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
generic_textual HIGH https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
cvssv3.1 7.5 https://go-review.googlesource.com/c/crypto/+/278852
generic_textual HIGH https://go-review.googlesource.com/c/crypto/+/278852
cvssv3.1 7.5 https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
generic_textual HIGH https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
cvssv3.1 7.5 https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
generic_textual HIGH https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2020-29652
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-29652
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2020-29652
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2021-0227
generic_textual HIGH https://pkg.go.dev/vuln/GO-2021-0227
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-29652.json
https://api.first.org/data/v1/epss?cve=CVE-2020-29652
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go.dev/cl/278852
https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
https://pkg.go.dev/vuln/GO-2021-0227
1908883 https://bugzilla.redhat.com/show_bug.cgi?id=1908883
cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:*
RHSA-2020:5633 https://access.redhat.com/errata/RHSA-2020:5633
RHSA-2021:0799 https://access.redhat.com/errata/RHSA-2021:0799
RHSA-2021:1796 https://access.redhat.com/errata/RHSA-2021:1796
RHSA-2021:2920 https://access.redhat.com/errata/RHSA-2021:2920
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-29652.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/cl/278852
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go-review.googlesource.com/c/crypto/+/278852
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2020-29652
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-29652
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pkg.go.dev/vuln/GO-2021-0227
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07245
EPSS Score 0.00032
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:13:59.613095+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-3vm4-22fp-5rfm/GHSA-3vm4-22fp-5rfm.json 37.0.0