CVE-2017-3204: golang.org/x/crypto/ssh Man-in-the-Middle attack
8.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.84206%
CWE
-
Published
2/7/2023
Updated
4/19/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/crypto | go | < 0.0.0-20170330155735-e4e2799dd7aa | 0.0.0-20170330155735-e4e2799dd7aa |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from ClientConfig.HostKeyCallback defaulting to nil, which prior to commit e4e2799 meant accepting any host key. The NewClientConn function (called by Dial) contained the critical security check logic. The commit diff shows explicit validation was added to NewClientConn to reject nil HostKeyCallback, confirming these were the entry points for insecure connections. Both functions became safe only after forcing explicit host key verification.