reports: add GO-2021-0227.yaml for CVE-2020-29652
Fixes golang/vulndb#227
Change-Id: I32faddb1932501ffb7dd4444e7e2f192052c3042
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/377580
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
diff --git a/reports/GO-2021-0227.yaml b/reports/GO-2021-0227.yaml
new file mode 100644
index 0000000..5a61ed9
--- /dev/null
+++ b/reports/GO-2021-0227.yaml
@@ -0,0 +1,19 @@
+module: golang.org/x/crypto
+package: golang.org/x/crypto/ssh
+versions:
+- fixed: v0.0.0-20201216223049-8b5274cf687f
+description: |
+ Clients can cause a panic in SSH servers. An attacker can craft
+ an authentication request message for the “gssapi-with-mic” method
+ which will cause NewServerConn to panic via a nil pointer dereference
+ if ServerConfig.GSSAPIWithMICConfig is nil.
+cves:
+- CVE-2020-29652
+credit: 'Joern Schneewesiz, GitLab Security Research Team'
+symbols:
+- connection.serverAuthenticate
+links:
+ pr: https://go-review.googlesource.com/c/crypto/+/278852
+ commit: https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
+ context:
+ - https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
