Go SSH Agent Message Size Validation Vulnerability Leading to Panic

A vulnerability exists in the SSH Agent server implementation in the Go programming language's crypto package. This issue arises because the server does not properly validate the size of messages when handling new identity requests. As a result, if a message is malformed, it can cause an out-of-bounds read, leading the program to panic. This vulnerability affects all versions of the golang.org/x/crypto/ssh/agent package prior to 0.45.0.

Impact

Exploitation of this vulnerability causes the Go program to panic, potentially leading to a denial of service.

Remediation

Users can upgrade to Go version 0.45.0 or later, where this vulnerability has been fixed.