Version v0.0.0-20200220183623-bac4c82f6975 of golang.org/x/crypto
fixes a vulnerability in the golang.org/x/crypto/ssh
package which allowed peers to cause a panic in SSH servers that accept public keys and in any SSH client.
An attacker can craft an ssh-ed25519 or sk-ssh-...@openssh.com
public key, such that the library will panic when trying to verify a signature with it. Clients can deliver such a public key and signature to any golang.org/x/crypto/ssh
server with a PublicKeyCallback, and servers can deliver them to any golang.org/x/crypto/ssh
This issue was discovered and reported by Alex Gaynor, Fish in a Barrel, and is tracked as CVE-2020-9283.
Filippo for the Go team