CVE-2017-3204: High severity Golang crypto vulnerability
The Go SSH library (golang.org/x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks if ClientConfig.HostKeyCallback is not set. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
Other sources
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/cryptoto a version that resolves this vulnerability.Fixed in 0.0.0-20170330155735-e4e2799dd7aa - Configuration
Update Go SSH client configuration to explicitly set ClientConfig.HostKeyCallback so the client verifies server host keys, preventing man-in-the-middle attacks. (Behavior change mentioned for commit e4e2799 requiring explicit hostkey verification mechanism registration.)
golang.org/x/crypto/ssh (Go SSH) ClientConfig HostKeyCallback = Set to an explicit host key verification mechanism (do not leave unset)
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3204?
CVE-2017-3204 is considered a medium severity vulnerability due to the risk of man-in-the-middle attacks.
How do I fix CVE-2017-3204?
To fix CVE-2017-3204, ensure that the ClientConfig.HostKeyCallback is explicitly set to verify host keys.
Which versions of the Go SSH library are affected by CVE-2017-3204?
CVE-2017-3204 affects versions of the Go SSH library prior to the commit e4e2799.
What type of attack does CVE-2017-3204 facilitate?
CVE-2017-3204 facilitates man-in-the-middle attacks by not verifying host keys.
Is there a default security risk with the Go SSH library as per CVE-2017-3204?
Yes, the default behavior of the Go SSH library does not verify host keys, posing a security risk.