Go Programming Language Ed25519 Private Key Panic Vulnerability in SSH Agent

A vulnerability exists in the Go programming language's SSH agent implementation, specifically in the 'golang.org/x/crypto/ssh/agent' package, prior to version 0.52.0. This vulnerability arises from the creation of an 'ed25519.PrivateKey' by improperly casting malformed wire bytes. When this malformed key is used, it causes a panic, disrupting the application's normal operation.

Impact

Exploitation of this vulnerability leads to a panic in the SSH client, causing a disruption in service.

Remediation

Users can update to Go version v0.52.0 or later, where this vulnerability has been addressed.