PT-2017-4225 · Go · Golang.Org/X/Crypto/Ssh

Phil Pennock · Published 2017-04-04 · Updated 2026-01-22 · CVE-2017-3204

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions golang.org/x/crypto/ssh versions prior to the version that includes commit e4e2799

Description The issue is related to the default behavior of the Go SSH library, which does not verify host keys. This facilitates man-in-the-middle attacks if the ClientConfig.HostKeyCallback is not set. The lack of host key verification allows a remote attacker to execute a man-in-the-middle attack.

Recommendations For versions prior to the one including commit e4e2799, consider explicitly registering a hostkey verification mechanism by setting ClientConfig.HostKeyCallback to prevent man-in-the-middle attacks. As a temporary workaround, ensure that ClientConfig.HostKeyCallback is set for all SSH client configurations to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2022-06638

CVE-2017-3204

GHSA-XHJQ-W7XM-P8QJ

GO-2020-0013

Affected Products

Golang.Org/X/Crypto/Ssh

References · 24

• https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991 · Patch
• https://osv.dev/vulnerability/CVE-2017-3204 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2020-0013 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-3204 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xhjq-w7xm-p8qj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3204 · Security Note
• https://godoc.org/golang.org/x/crypto/ssh · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06638 · Security Note
• https://ubuntu.com/security/CVE-2017-3204 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-3204 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-3204 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-3204 · Vendor Advisory
• https://github.com/golang/go/issues/19767 · Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-3204 · Note
• https://go.googlesource.com/crypto/+/e4e2799dd7aab89f583e1d898300d96367750991 · Note