PT-2024-28396 · Gost+1 · Gost+1

Sy2339226 · Published 2024-07-03 · Updated 2024-11-05 · CVE-2024-39223

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gost version 2.11.5

Description An authentication bypass in the SSH service allows attackers to intercept communications by setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey. This issue is related to missing key verification in gost.

Recommendations For gost version 2.11.5, consider disabling the SSH service until a patch is available. As a temporary workaround, avoid setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey to prevent authentication bypass. Restrict access to the SSH service to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-289

CWE-639

Related Identifiers

CVE-2024-39223

GHSA-8WXX-35QC-VP6R

GO-2024-3224

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Suse

Gost

References · 77

• https://osv.dev/vulnerability/GO-2024-3224 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39223 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-39223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-39223 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39223 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8wxx-35qc-vp6r · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229 · Note
• https://github.com/ginuerzh/gost/issues/1034 · Note
• https://github.com/ginuerzh/gost · Note
• https://suse.com/security/cve/CVE-2024-9180 · Note
• https://suse.com/security/cve/CVE-2024-47003 · Note