CVE-2020-29652: 
NixOS vulnerability analysis and mitigation

A nil pointer dereference vulnerability (CVE-2020-29652) was discovered in the golang.org/x/crypto/ssh component through version v0.0.0-20201203163018-be400aefbc4c. The vulnerability was identified in December 2020 and affects Go-based SSH servers (NVD, MITRE).

The vulnerability occurs when using the library's SSH server implementation without specifying an option for GSSAPIWithMICConfig. An attacker can craft an authentication request message for the 'gssapi-with-mic' method which causes NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability allows remote attackers to cause a denial of service condition against SSH servers implementing the affected component. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NVD).

The vulnerability can be exploited remotely without requiring any privileges or user interaction. The attack complexity is considered low, making it relatively straightforward for attackers to exploit (NVD).

The vulnerability was fixed in golang.org/x/crypto version v0.0.0-20201216223049-8b5274cf687f. Users are advised to upgrade to this version or later to address the vulnerability. The issue was discovered and reported by Joern Schneewesiz from the GitLab Security Research Team (Golang Announce).