CVE-2020-9283: 
Packer vulnerability analysis and mitigation

The vulnerability CVE-2020-9283 affects golang.org/x/crypto before version v0.0.0-20200220183623-bac4c82f6975. The vulnerability allows a panic during signature verification in the golang.org/x/crypto/ssh package, where a client can attack an SSH server that accepts public keys, and a server can attack any SSH client (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue specifically involves the processing of crafted SSH ed25519 public keys that can cause applications using the SSH package of the golang.org/x/crypto library to stop working (NVD, Red Hat).

The vulnerability can lead to a denial of service condition when processing invalid public keys. When exploited, it can cause the affected application to panic and stop working, impacting the availability of SSH services (Debian LTS).

The vulnerability has been fixed in golang.org/x/crypto version v0.0.0-20200220183623-bac4c82f6975 and later. Various Linux distributions have released security updates to address this vulnerability, including Debian and Red Hat. Users are recommended to upgrade their golang-go.crypto packages to the latest version (Debian LTS, Red Hat).