CVE-2017-3204
mediumpriority · track · 33EPSS 0.032 · 88 %ileEURUUSEPSS · scored 2026-10-28
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–8.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-xhjq-w7xm-p8qjgolang.org/x/crypto/ssh Man-in-the-Middle attack2023-02-07ghsa · osvUS
The Go SSH library (golang.org/x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks if ClientConfig.HostKeyCallback is not set. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
- GO-2020-0013Man-in-the-middle attack in golang.org/x/crypto/ssh2021-04-14vendor · osvUS
By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/cnnvd
- https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991cnnvd
- https://github.com/golang/go/issues/19767cnnvd
- https://godoc.org/golang.org/x/crypto/sshcnnvd
- https://www.securityfocus.com/bid/97481cnnvd
- http://www.securityfocus.com/bid/97481enisa_euvd
- https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/enisa_euvd
- https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan