Authentication Bypass

github.com/ginuerzh/gost is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of the HostKeyCallback function. An attacker can intercept communications by setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

Missing key verification in gost

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

GHSA-8WXX-35QC-VP6R Missing key verification in gost

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

CVE-2024-39223

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

CVE-2024-39223

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

PT-2024-28396 · Gost +1 · Gost +1

Name of the Vulnerable Software and Affected Versions: gost version 2.11.5 Description: An authentication bypass in the SSH service allows attackers to intercept communications by setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey. This issue is related to missing key verification ...

CVE-2024-39223

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

CVE-2024-39223

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

Man-in-the-middle (MitM)

github.com/golang/crypto is vulnerable to man-in-the-middle MitM attacks. The HostKeyCallback function currently interprets nil as to accept any host keys. A MitM server can allow the login to succeed and get the agemt to authenticate to the actual server...

PT-2017-4225 · Go · Golang.Org/X/Crypto/Ssh

Name of the Vulnerable Software and Affected Versions: golang.org/x/crypto/ssh versions prior to the version that includes commit e4e2799 Description: The issue is related to the default behavior of the Go SSH library, which does not verify host keys. This facilitates man-in-the-middle attacks if...