Man-in-the-Middle (MitM) Affecting golang.org/x/crypto/ssh package, versions
Threat Intelligence
EPSS
0.24% (63rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GOLANGORGXCRYPTOSSH-50032
- published 30 Mar 2017
- disclosed 30 Mar 2017
- credit Phil Pennock
Introduced: 30 Mar 2017
CVE-2017-3204 Open this link in a new tabHow to fix?
Upgrade github.com/golang/crypto/ssh to commit e4e2799 or higher.
Overview
Affected versions of github.com/golang/crypto/ssh are vulnerable to Man-in-the-middle (MitM) attacks.
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
References
CVSS Scores
version 3.1