Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh