Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-27191

28
FAUCET Score

CVE-2022-27191 is a high-severity denial-of-service vulnerability affecting the golang.org/x/crypto/ssh package prior to version 0.0.0-20220314234659-1baeb1ce4c0b, impacting products like Fedora and Red Hat. An unauthenticated attacker can remotely crash a server under specific conditions related to the AddHostKey function. While the CVSS score is 7.5, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 0.0.0-20220314234659-1baeb1ce4c0bCPE matchmatch criteria
cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
34CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
35CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
36CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.93%
Probability of exploitation in next 30 days
EPSS Percentile
89.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0393 is in the 81st percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (112)

gopatch availablevia ghsa
Product: golang.org/x/cryptoFixed in: 0.0.0-20220314234659-1baeb1ce4c0b
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.13Fixed in: openshift4/ose-installer:v4.13.0-202305091542.p0.g44db7b2.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4-wincw/windows-machine-config-rhel8-operator:6.0.1-38
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4/ose-node-feature-discovery:v4.12.0-202301042354.p0.g5e2696b.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4-wincw/windows-machine-config-rhel8-operator:7.0.0-22
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.13Fixed in: openshift-clients-0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.13Fixed in: openshift-clients-0:4.13.0-202305291355.p0.g1024efc.assembly.stream.el9
View patch
redhatpatch availablevia redhat_api
Product: RHACS-4.1-RHEL-8Fixed in: advanced-cluster-security/rhacs-main-rhel8:4.1.0-13
View patch
redhatpatch availablevia redhat_api
Product: RHEL-7-CNV-4.11Fixed in: kubevirt-0:4.11.0-643.el7
View patch
redhatpatch availablevia redhat_api
Product: RHEL-8-CNV-4.11Fixed in: kubevirt-0:4.11.0-643.el8
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/client-kn-rhel8:1.5.0-3
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-controller-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.5.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.5.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-kafka-broker-receiver-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.5.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-mtping-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-storage-version-migration-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/eventing-webhook-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/func-utils-rhel8:1.26.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/ingress-rhel8-operator:1.26.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/knative-rhel8-operator:1.26.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/kn-cli-artifacts-rhel8:1.5.0-4
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/kourier-control-rhel8:1.5.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/net-istio-controller-rhel8:1.5.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/net-istio-webhook-rhel8:1.5.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serverless-operator-bundle:1.26.0-5
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serverless-rhel8-operator:1.26.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-activator-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-autoscaler-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-controller-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-domain-mapping-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-queue-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-storage-version-migration-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/serving-webhook-rhel8:1.5.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1/svls-must-gather-rhel8:1.26.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8:1.5.0-1
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.26-RHEL-8Fixed in: openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8:1.26.0-5
View patch
redhatpatch availablevia redhat_api
Product: OADP-1.1-RHEL-8Fixed in: oadp/oadp-velero-rhel8:1.1.1-20
View patch
redhatpatch availablevia redhat_api
Product: Openshift Serverless 1 on RHEL 8Fixed in: openshift-serverless-clients-0:1.5.0-3.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8-8070020220929222448.39077419
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:4.0-8070020220830101436.39077419
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: podman-2:4.2.0-3.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: buildah-1:1.27.0-2.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: cri-o-0:1.24.1-11.rhaos4.11.gitb0d2ef3.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-aws-ebs-csi-driver-rhel8:v4.11.0-202208020235.p0.g7564046.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-azure-disk-csi-driver-rhel8:v4.11.0-202208020235.p0.g0fe424e.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-azure-file-csi-driver-rhel8:v4.11.0-202208020235.p0.g67c3831.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-csi-driver-manila-rhel8:v4.11.0-202208020235.p0.g246ae15.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-csi-driver-nfs-rhel8:v4.11.0-202208020235.p0.gf144bb4.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-machine-api-provider-azure-rhel8:v4.11.0-202208020706.p0.g93b3f9e.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-openstack-cinder-csi-driver-rhel8:v4.11.0-202208020235.p0.g246ae15.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-openstack-cloud-controller-manager-rhel8:v4.11.0-202208020235.p0.g246ae15.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-vmware-vsphere-csi-driver-rhel8:v4.11.0-202208020235.p0.gd4721ba.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-vsphere-csi-driver-rhel8:v4.11.0-202208020235.p0.gd4721ba.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-installer:v4.11.0-202212070956.p0.g7e60d78.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-baremetal-installer-rhel8:v4.11.0-202212202214.p0.gd3fb15a.assembly.stream
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.11Fixed in: openshift4/ose-installer-artifacts:v4.11.0-202212202214.p0.gd3fb15a.assembly.stream
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-hypershift-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: podman
redhatno patchvia redhat_api
Product: Migration Toolkit for ContainersFixed in: cpma
redhatno patchvia redhat_api
Product: Migration Toolkit for ContainersFixed in: rhmtc/openshift-migration-controller-rhel8
redhatno patchvia redhat_api
Product: Migration Toolkit for ContainersFixed in: rhmtc/openshift-migration-velero-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift Virtualization 4Fixed in: container-native-virtualization/libguestfs-tools
redhatno patchvia redhat_api
Product: OpenShift Service Mesh 2.0Fixed in: servicemesh
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/multicluster-operators-subscription-release-rhel8
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/multicluster-operators-subscription-rhel8
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/openshift-hive-rhel8
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/volsync-mover-rclone-rhel8
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/volsync-mover-restic-rhel8
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Security 3Fixed in: advanced-cluster-security/rhacs-docs-rhel8
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Security 3Fixed in: advanced-cluster-security/rhacs-main-rhel8
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Security 3Fixed in: advanced-cluster-security/rhacs-rhel8-operator
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Security 3Fixed in: advanced-cluster-security/rhacs-roxctl-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift Virtualization 4Fixed in: container-native-virtualization/virt-launcher
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-azure-machine-controllers
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-aws-efs-csi-driver-container-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-vsphere-csi-driver-syncer-rhel9
redhatend of lifevia redhat_api
Product: OpenShift Developer Tools and ServicesFixed in: odo
redhatend of lifevia redhat_api
Product: Red Hat Advanced Cluster Security 3Fixed in: advanced-cluster-security/rhacs-scanner-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: atomic-enterprise-service-catalog
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift
redhatend of lifevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-bridge-operator-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Virtualization 2Fixed in: hyperconverged-cluster-operator-container
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-hello-openshift-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-hyperkube
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-local-storage-static-provisioner
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-tests
redhatend of lifevia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/cephcsi-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/applicationset-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argocd-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/gitops-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/kam-delivery-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-kam
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Virtualization 2Fixed in: cluster-network-addons-operator-container
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Virtualization 4Fixed in: container-native-virtualization/cluster-network-addons-operator
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Virtualization 2Fixed in: kubemacpool-container
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Virtualization 2Fixed in: kubevirt
redhatend of lifevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-builder-rhel8
redhatend of lifevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-container-security-operator-rhel8
redhatend of lifevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-operator-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Virtualization 2Fixed in: virt-launcher-container

Vendor Advisories (2)

goGHSA-8c26-wmh5-6g9vhigh

golang.org/x/crypto/ssh Denial of service via crafted Signer

Mar 19, 2022
redhatCVE-2022-27191Moderate

golang: crash in a golang.org/x/crypto/ssh server

Mar 15, 2022

References

groups.google.com / g/golang-announce
Mailing ListThird Party Advisory
groups.google.com / g/golang-announce/c/-cp44ypCT5s
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR
security.netapp.com / advisory/ntap-20220429-0002
Third Party Advisory