critical9.8
CVE-2024-39223
Missing key verification in gost
Impact
An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ginuerzh/gost | <= 2.11.5 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
- https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229
- https://github.com/ginuerzh/gost/issues/1034
- https://github.com/advisories/GHSA-8wxx-35qc-vp6r
- https://nvd.nist.gov/vuln/detail/CVE-2024-39223