CVE-2020-9283: Debian Linux

High severity, CVSS 7.5. EPSS: 20.9% chance of exploitation in the next 30 days.

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

Affected products

• Debian Debian Linux: version 9.0 only
• Golang Package SSH: version 0.0.0-20200220183623-bac4c82f6975 only

Published 2020-02-20. Last modified 2026-06-17.