Search for vulnerabilities
Vulnerability details: VCID-ry8c-bjrc-aaaj
Vulnerability ID VCID-ry8c-bjrc-aaaj
Aliases CVE-2020-29652
GHSA-3vm4-22fp-5rfm
Summary A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-476 NULL Pointer Dereference
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2020:5633
rhas Moderate https://access.redhat.com/errata/RHSA-2020:5635
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0799
rhas Moderate https://access.redhat.com/errata/RHSA-2021:1796
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2920
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-29652.json
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00568 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-29652
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=1908883
cvssv3.1 7.5 https://go.dev/cl/278852
generic_textual HIGH https://go.dev/cl/278852
cvssv3.1 7.5 https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
generic_textual HIGH https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
cvssv3.1 7.5 https://go-review.googlesource.com/c/crypto/+/278852
generic_textual HIGH https://go-review.googlesource.com/c/crypto/+/278852
cvssv3.1 7.5 https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
generic_textual HIGH https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
cvssv3.1 8.6 https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
generic_textual HIGH https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2020-29652
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-29652
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-29652
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2021-0227
generic_textual HIGH https://pkg.go.dev/vuln/GO-2021-0227
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-29652.json
https://api.first.org/data/v1/epss?cve=CVE-2020-29652
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go.dev/cl/278852
https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E
https://pkg.go.dev/vuln/GO-2021-0227
1908883 https://bugzilla.redhat.com/show_bug.cgi?id=1908883
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:*
CVE-2020-29652 https://nvd.nist.gov/vuln/detail/CVE-2020-29652
RHSA-2020:5633 https://access.redhat.com/errata/RHSA-2020:5633
RHSA-2020:5635 https://access.redhat.com/errata/RHSA-2020:5635
RHSA-2021:0799 https://access.redhat.com/errata/RHSA-2021:0799
RHSA-2021:1796 https://access.redhat.com/errata/RHSA-2021:1796
RHSA-2021:2920 https://access.redhat.com/errata/RHSA-2021:2920
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-29652.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/cl/278852
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go-review.googlesource.com/c/crypto/+/278852
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2020-29652
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-29652
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-29652
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pkg.go.dev/vuln/GO-2021-0227
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.03717
EPSS Score 0.00023
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.