GHSA-8wxx-35qc-vp6r

Source

https://github.com/advisories/GHSA-8wxx-35qc-vp6r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-8wxx-35qc-vp6r/GHSA-8wxx-35qc-vp6r.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-8wxx-35qc-vp6r

Aliases

CVE-2024-39223
GO-2024-3224

Published

2024-07-03T18:48:20Z

Modified

2024-10-28T15:56:55.937385Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Missing key verification in gost

Details

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey

Database specific

{
    "nvd_published_at": "2024-07-03T15:15:06Z",
    "cwe_ids": [
        "CWE-289",
        "CWE-639"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-25T22:07:23Z"
}

References

Affected packages

Go / github.com/ginuerzh/gost

Package

Name: github.com/ginuerzh/gost; View open source insights on deps.dev
Purl: pkg:golang/github.com/ginuerzh/gost

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.11.5