GitHub Advisoryadvisory · Go

GHSA-8wxx-35qc-vp6r Missing key verification in gost

CRITICAL Published 2024-07-03 Modified 2024-10-25 Official page ↗

Aliases: CVE-2024-39223
Ecosystem: Go
Packages: github.com/ginuerzh/gost
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-289, CWE-639
Reviewed: 2024-10-25

Affected packages

• Go github.com/ginuerzh/gost: <= 2.11.5 (no fix yet)

Description

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey

Alias · CVE (1)

CVE-2024-39223 An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback… vulnerability

Weakness · CWE (2)

CWE-289 Authentication Bypass by Alternate Name weakness
CWE-639 Authorization Bypass Through User-Controlled Key weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2024-39223 advisory
https://github.com/ginuerzh/gost/issues/1034 web
https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a web
https://github.com/ginuerzh/gost package
https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229 web