Vulnerability Report: GO-2020-0013
- CVE-2017-3204, GHSA-xhjq-w7xm-p8qj
- Affects: golang.org/x/crypto
- Published: Apr 14, 2021
- Modified: May 20, 2024
By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set.
Affected Packages
-
PathVersionsSymbols
-
before v0.0.0-20170330155735-e4e2799dd7aa
Aliases
References
- https://go.dev/cl/38701
- https://go.googlesource.com/crypto/+/e4e2799dd7aab89f583e1d898300d96367750991
- https://go.dev/issue/19767
- https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/
- https://vuln.go.dev/ID/GO-2020-0013.json
Credits
- Phil Pennock
Feedback
See anything missing or incorrect?
Suggest an edit to this report.