CVE-2020-29652

High

Advisory

Published 17 Feb 2022In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.033; 88th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 420; of 17,781 indexed, latest versions
Container images: 416; deployed by those charts
Fix available: 1 of 1; affected package

golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability

Carried by container images the latest versions of 420 of 17,781 indexed charts deploy, on 416 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/cryptogolang	v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+52 more	0.0.0-20201216223049-8b5274cf687f	416

OSV records: GHSA-3vm4-22fp-5rfm
Also known as: GO-2021-0227

Charts affected

420 by stars

Chart

Latest

Affected images

Radar Score

verzoekconversieserviceverzoekconversieservice

1.0.0

1 of 3 See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

7,528

verzoekregistratiecomponentverzoekregistratiecomponent

1.1.0

1 of 4 See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

7,429

verzoektypecatalogusverzoektypecatalogus

1.1.0

1 of 4 See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

7,429

volantmqvolantmq

0.1.2

1 of 1 See more

volantmq volantmq 0.1.2

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
volantmq/volantmq :v0.4.0-rc.6	9bfe7857ebc3	golang.org/x/crypto@v0.0.0-20190927123631-a832865fa7ad	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

2,550

cert-manager-webhook-vultrvultr

1.0.0

1 of 1 See more

cert-manager-webhook-vultr vultr 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
vultr/cert-manager-webhook-vultr :v0.1.0	541c3e0aec58	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

2,500

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.4	5a065930682d	golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

5,484

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

11,119

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

7,552

athens-proxywenerme

0.5.2

1 of 2 See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
gomods/athens :v0.11.0	efb811df7844	golang.org/x/crypto@v0.0.0-20191206172530-e9b2fee46413	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

4,984

cadencewenerme

0.23.0

1 of 5 See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
ubercadence/server :0.23.2	2ac5491d13bb	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

10,127

filebrowserwenerme

1.0.0

1 of 1 See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
filebrowser/filebrowser :v2.13.0	c5d0a75a0041	golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

3,174

frpcwenerme

1.0.1

1 of 1 See more

frpc wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
wener/frpc :v0.37.0	cc9fd4da44c0	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

3,359

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	golang.org/x/crypto@v0.0.0-20201124201722-c8d3bf9c5392	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

6,915

nfs-subdir-external-provisionerwenerme

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner wenerme 4.0.18

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

2,743

temporalwenerme

0.15.1

3 of 13 See more

temporal wenerme 0.15.1

3 of the 13 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
grafana/grafana :6.7.1	1ff3999e0fc0	golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550	0.0.0-20201216223049-8b5274cf687f
prom/alertmanager :v0.20.0	7e4e9f7a0954	golang.org/x/crypto@v0.0.0-20190617133340-57b3e21c3d56	0.0.0-20201216223049-8b5274cf687f
prom/prometheus :v2.16.0	e4ca62c0d62f	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

22,665

traefikwenerme

9.1.1

1 of 1 See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
library/traefik :2.2.8	f5af5a5ce17f	golang.org/x/crypto@v0.0.0-20200317142112-1b76d66859c6	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

3,369

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

2,745

dex-k8s-authenticatorwiremind

1.7.0

1 of 1 See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

2,791

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

3,023

zahori-consulzahori

1.0.1

1 of 2 See more

zahori-consul zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2020-29652.

Container image	Digest	Package	Fixed in
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.0.0-20201216223049-8b5274cf687f

Open the chart page →

5,033

Container images carrying it

416 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/mongodb/mongodb-kubernetes-operator :0.3.0	107a7c73af59	golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975	0.0.0-20201216223049-8b5274cf687f	1
quay.io/oauth2-proxy/oauth2-proxy :v6.1.1	791aef35b8d1	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20201216223049-8b5274cf687f	1
quay.io/oauth2-proxy/oauth2-proxy :v7.1.3	ecd26b74a01f	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f	1
quay.io/openshift/origin-cli :4.6	6722d5041b47	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f	1
quay.io/opsmxpublic/spin-sample-pipeline :v1.0.1	c6a934439421	golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550	0.0.0-20201216223049-8b5274cf687f	1
quay.io/redhat-cop/cert-utils-operator :v1.3.12	0290e7b2800a	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.0.0-20201216223049-8b5274cf687f	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975	0.0.0-20201216223049-8b5274cf687f	1
quay.io/rimusz/hostpath-provisioner :v0.2.5	87f0398ec7ff	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f	1
quay.io/thanos/thanos :v0.17.1	e362f02ed304	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.0.0-20201216223049-8b5274cf687f	1
quay.io/tigera/operator :v1.20.1	379efe0c2541	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f	1
quay.io/tigera/operator :v1.15.1	c6591da87aa8	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f	1
quay.io/titansoft/imagepullsecret-patcher :v0.14	21e6d6a155dc	golang.org/x/crypto@v0.0.0-20190820162420-60c769a6c586	0.0.0-20201216223049-8b5274cf687f	1
quay.io/uswitch/kiam :v4.0	be3a5846922d	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.0.0-20201216223049-8b5274cf687f	1
registry.gitlab.com/commento/commento :v1.8.0	e0ab1fc86761	golang.org/x/crypto@v0.0.0-20180808211826-de0752318171	0.0.0-20201216223049-8b5274cf687f	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	golang.org/x/crypto@v0.0.0-20190530122614-20be4c3c3ed5	0.0.0-20201216223049-8b5274cf687f	1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.0	3ce0fdba4d8e	golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975	0.0.0-20201216223049-8b5274cf687f	1