CVE-2017-3204
Description
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2017-3204 NameCVE-2017-3204 DescriptionThe Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub…
CVE-2017-3204
| Name | CVE-2017-3204 |
| Description | The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 859655 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| golang-go.crypto (PTS) | bullseye | 1:0.0~git20201221.eec23a3-1 | fixed |
| bookworm | 1:0.4.0-1 | fixed | |
| trixie | 1:0.25.0-1 | fixed | |
| forky, sid | 1:0.52.0-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| golang-go.crypto | source | (unstable) | 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1 | 859655 |
Notes
[jessie] - golang-go.crypto <ignored> (In jessie no rdeps using SSH, that version doesn't even support host key validation)
https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991
https://github.com/golang/go/issues/19767
Apply commands
[jessie] - golang-go.crypto <ignored> (In jessie no rdeps using SSH, that version doesn't even support host key validation)https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991https://github.com/golang/go/issues/19767OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1 |
| sid | Fixed | 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1 |
| forky | Fixed | 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1 |
| bullseye | Fixed | 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1 |
| bookworm | Fixed | 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | golang.org/x/crypto | <0.0.0-20170330155735-e4e2799dd7aa | 0.0.0-20170330155735-e4e2799dd7aa |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| golang | crypto | {"endIncluding":"2017-03-17"} | |
References
- http://www.securityfocus.com/bid/97481
- https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/
- https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991
- https://github.com/golang/go/issues/19767
- https://godoc.org/golang.org/x/crypto/ssh
- https://nvd.nist.gov/vuln/detail/CVE-2017-3204
- https://bridge.grumpy-troll.org/2017/04/golang-ssh-security
- https://go.dev/cl/340830
- https://go.dev/cl/38701
- https://go.dev/issue/19767
- https://go.googlesource.com/crypto/+/e4e2799dd7aab89f583e1d898300d96367750991
- https://pkg.go.dev/vuln/GO-2020-0013
- https://web.archive.org/web/20170423080311/https://www.securityfocus.com/bid/97481
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-3204
- https://security-tracker.debian.org/tracker/CVE-2017-3204
CWEs
CWE-310
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.