GO-2020-0013

vendorUSosv

Man-in-the-middle attack in golang.org/x/crypto/ssh

view advisory published 2021-04-14Licence: per source

By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-3204US	high8.1	3.16% (88th)	—	2017-04-04
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly reg…

references

External citations — patches, advisories, analysis.

https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/WEB
https://go.dev/cl/38701FIX
https://go.dev/issue/19767REPORT
https://go.googlesource.com/crypto/+/e4e2799dd7aab89f583e1d898300d96367750991FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan